URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a...
Submission Tags: falconsandbox
Submission: On February 20 via api from US

Summary

This website contacted 102 IPs in 10 countries across 86 domains to perform 454 HTTP transactions. The main IP is 192.104.183.109, located in United States and belongs to LEE-ASN, US. The main domain is www.southbendtribune.com.
TLS certificate: Issued by R3 on January 5th 2021. Valid for: 3 months.
This is the only time www.southbendtribune.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
18 192.104.183.109 10668 (LEE-ASN)
35 104.18.130.43 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
9 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
14 2a00:1450:400... 15169 (GOOGLE)
6 65.9.24.128 16509 (AMAZON-02)
24 142.250.186.162 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 7 54.81.50.0 14618 (AMAZON-AES)
11 2600:9000:206... 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 184.30.21.59 16625 (AKAMAI-AS)
1 107.178.250.234 15169 (GOOGLE)
2 52.54.243.67 14618 (AMAZON-AES)
2 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
13 2a00:1450:400... 15169 (GOOGLE)
3 52.8.46.140 16509 (AMAZON-02)
1 4 199.232.137.44 54113 (FASTLY)
1 13.32.24.29 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 3 184.25.115.49 16625 (AKAMAI-AS)
3 141.226.228.48 200478 (TABOOLA-AS)
15 199.10.29.123 36483 (GOSSAMERT...)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
39 2a00:1450:400... 15169 (GOOGLE)
1 5 52.95.124.165 16509 (AMAZON-02)
3 104.215.88.166 8075 (MICROSOFT...)
5 151.101.14.62 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
4 104.108.50.124 16625 (AKAMAI-AS)
6 22 34.98.64.218 15169 (GOOGLE)
12 39 2a00:1450:400... 15169 (GOOGLE)
3 3 2620:116:800d... 16509 (AMAZON-02)
5 5 37.157.6.252 198622 (ADFORM)
7 11 52.16.108.17 16509 (AMAZON-02)
3 4 142.250.74.194 15169 (GOOGLE)
5 9 69.173.144.139 26667 (RUBICONPR...)
1 35.244.207.62 15169 (GOOGLE)
1 1 69.173.144.138 26667 (RUBICONPR...)
1 2 2a00:1288:80:... 203220 (YAHOO-DEB)
5 5 185.29.133.52 30419 (MEDIAMATH...)
4 4 151.101.114.49 54113 (FASTLY)
2 34.120.207.148 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
4 52.4.152.106 14618 (AMAZON-AES)
4 72.251.249.14 29791 (VOXEL-DOT...)
8 16 185.33.221.50 29990 (ASN-APPNEX)
4 213.19.147.210 3356 (LEVEL3)
12 18.211.21.136 14618 (AMAZON-AES)
4 23.37.38.181 16625 (AKAMAI-AS)
1 18.198.115.155 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:211... 16509 (AMAZON-02)
1 65.9.91.133 16509 (AMAZON-02)
1 2600:9000:211... 16509 (AMAZON-02)
8 3.130.148.110 16509 (AMAZON-02)
1 2600:9000:20d... 16509 (AMAZON-02)
4 52.200.180.114 14618 (AMAZON-AES)
1 2600:9000:20d... 16509 (AMAZON-02)
3 151.101.113.194 54113 (FASTLY)
1 185.64.189.112 62713 (AS-PUBMATIC)
1 69.173.144.143 26667 (RUBICONPR...)
1 52.58.167.129 16509 (AMAZON-02)
2 104.16.68.69 13335 (CLOUDFLAR...)
1 2 108.129.8.178 16509 (AMAZON-02)
1 18.196.104.43 16509 (AMAZON-02)
1 178.162.133.150 60781 (LEASEWEB-...)
1 162.210.196.208 30633 (LEASEWEB-...)
1 136.144.59.88 54825 (PACKET)
1 2600:9000:211... 16509 (AMAZON-02)
16 16 52.215.8.160 16509 (AMAZON-02)
3 24 185.64.190.80 62713 (AS-PUBMATIC)
2 2 185.86.139.114 201081 (SMARTADSE...)
3 3 198.148.27.140 19189 (PULSEPOINT)
2 5 178.162.133.149 60781 (LEASEWEB-...)
4 4 18.195.155.181 16509 (AMAZON-02)
9 9 213.19.147.150 3356 (LEVEL3)
1 51.75.146.200 16276 (OVH)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
2 184.30.20.198 16625 (AKAMAI-AS)
1 104.17.120.107 13335 (CLOUDFLAR...)
1 208.100.17.173 32748 (STEADFAST)
2 10 184.30.20.241 16625 (AKAMAI-AS)
1 151.101.13.108 54113 (FASTLY)
5 5 52.57.230.211 16509 (AMAZON-02)
2 2 192.96.200.41 30633 (LEASEWEB-...)
1 2 2a00:1288:110... 34010 (YAHOO-IRD)
1 185.64.190.78 62713 (AS-PUBMATIC)
1 178.250.0.163 44788 (ASN-CRITE...)
2 2 213.155.156.165 1299 (TELIANET ...)
1 1 85.114.159.118 24961 (MYLOC-AS ...)
1 1 87.98.242.60 16276 (OVH)
1 173.231.181.122 29791 (VOXEL-DOT...)
1 2 104.18.12.5 13335 (CLOUDFLAR...)
1 151.101.13.44 54113 (FASTLY)
2 3 35.227.248.159 15169 (GOOGLE)
2 2 3.127.88.255 16509 (AMAZON-02)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2 77.243.60.138 42697 (NETIC-AS)
2 2 35.201.96.126 15169 (GOOGLE)
1 185.64.189.249 62713 (AS-PUBMATIC)
1 159.253.128.183 36351 (SOFTLAYER)
2 2 18.156.0.31 16509 (AMAZON-02)
1 185.64.190.81 62713 (AS-PUBMATIC)
2 2 35.210.53.219 19527 (GOOGLE-2)
1 1 2001:678:cb4:... 56396 (TURN)
4 4 66.155.71.149 13768 (COGECO-PEER1)
1 2a02:fa8:8806... 41041 (VCLK-EU-SE)
1 1 159.65.197.210 14061 (DIGITALOC...)
1 1 34.98.107.212 15169 (GOOGLE)
1 1 185.33.221.53 29990 (ASN-APPNEX)
1 2 54.239.17.112 16509 (AMAZON-02)
1 1 18.198.126.47 16509 (AMAZON-02)
1 54.236.91.78 14618 (AMAZON-AES)
1 1 54.236.220.178 14618 (AMAZON-AES)
1 1 35.241.40.233 15169 (GOOGLE)
454 102
Apex Domain
Subdomains
Transfer
53 googlesyndication.com
4d99f37e7c8dc25469e4f8c942572412.safeframe.googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
aa8bde3daec928214ee0de2ce0048e90.safeframe.googlesyndication.com
454e894052a987406f58c9202386c9c1.safeframe.googlesyndication.com
c4981dc7ca65972f929725d0e6576531.safeframe.googlesyndication.com
edfb28179cb35161b9812e7370c51d1f.safeframe.googlesyndication.com
178 KB
51 doubleclick.net
stats.g.doubleclick.net
securepubads.g.doubleclick.net
survey.g.doubleclick.net
cm.g.doubleclick.net
953 KB
35 townnews.com
bloximages.newyork1.vip.townnews.com
412 KB
30 pubmatic.com
hbopenbid.pubmatic.com
image2.pubmatic.com
ads.pubmatic.com
image6.pubmatic.com
simage2.pubmatic.com
aud.pubmatic.com
image4.pubmatic.com
53 KB
22 openx.net
u.openx.net
us-u.openx.net
eu-u.openx.net
os4m-d.openx.net
insticator-d.openx.net
6 KB
18 adnxs.com
ib.adnxs.com
acdn.adnxs.com
secure.adnxs.com
31 KB
18 southbendtribune.com
www.southbendtribune.com
99 KB
17 cloudfront.net
d2zqfs55y95cft.cloudfront.net
d3oi8laqsvc6ey.cloudfront.net
d2na2p72vtqyok.cloudfront.net
d2s8wlbatk24s7.cloudfront.net
d3lcz8vpax4lo2.cloudfront.net
df80k0z3fi8zg.cloudfront.net
dh014lg6uwepv.cloudfront.net
273 KB
16 bidr.io
match.prod.bidr.io
8 KB
15 rubiconproject.com
eus.rubiconproject.com
token.rubiconproject.com
pixel-eu.rubiconproject.com
pixel.rubiconproject.com
fastlane.rubiconproject.com
29 KB
15 advertserve.com
bluellipse.advertserve.com
23 KB
14 googletagservices.com
www.googletagservices.com
375 KB
13 gstatic.com
fonts.gstatic.com
148 KB
13 amazon-adsystem.com
c.amazon-adsystem.com
aax-eu.amazon-adsystem.com
s.amazon-adsystem.com
71 KB
12 casalemedia.com
htlb.casalemedia.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
12 KB
12 yieldlift.com
x.yieldlift.com
8 KB
11 adsrvr.org
match.adsrvr.org
4 KB
10 ampproject.org
cdn.ampproject.org
197 KB
10 1rx.io
tag.1rx.io
sync.1rx.io
6 KB
10 googleapis.com
fonts.googleapis.com
storage.googleapis.com
912 KB
10 google.com
ampcid.google.com
www.google.com
adservice.google.com
2 KB
10 google-analytics.com
www.google-analytics.com
21 KB
9 google.de
ampcid.google.de
adservice.google.de
www.google.de
2 KB
8 includemodal.com
includemodal.com
1 KB
8 taboola.com
cdn.taboola.com
trc.taboola.com
trc-events.taboola.com
match.taboola.com
140 KB
7 civicscience.com
www.civicscience.com
2 KB
6 sonobi.com
apex.go.sonobi.com
sync.go.sonobi.com
5 KB
6 yahoo.com
ads.yahoo.com
cookiex.ngd.yahoo.com
pr-bh.ybp.yahoo.com
ups.analytics.yahoo.com
4 KB
5 bidswitch.net
x.bidswitch.net
2 KB
5 emxdgt.com
hb.emxdgt.com
cs.emxdgt.com
961 B
5 33across.com
ssc.33across.com
ssc-cms.33across.com
3 KB
5 mathtag.com
sync.mathtag.com
3 KB
5 adform.net
c1.adform.net
2 KB
5 gannett-cdn.com
www.gannett-cdn.com
134 KB
4 sitescout.com
pixel-sync.sitescout.com
2 KB
4 insticator.com
geoip.insticator.com
b2c.insticator.com
event.insticator.com
3 KB
4 lijit.com
ap.lijit.com
3 KB
4 everesttech.net
sync-tm.everesttech.net
1 KB
4 googletagmanager.com
www.googletagmanager.com
177 KB
3 tapad.com
pixel.tapad.com
1022 B
3 unrulymedia.com
sync.targeting.unrulymedia.com
2 KB
3 contextweb.com
bh.contextweb.com
2 KB
3 aralego.com
hb.aralego.com
sync.aralego.com
1 KB
3 fastly.net
confiant-integrations.global.ssl.fastly.net
104 KB
3 quantserve.com
pixel.quantserve.com
1 KB
3 mthsense.com
ads3.mthsense.com
10 KB
3 scorecardresearch.com
sb.scorecardresearch.com
3 KB
3 postrelease.com
jadserve.postrelease.com
2 KB
2 admedo.com
pool.admedo.com
786 B
2 fiftyt.com
visitor.fiftyt.com
990 B
2 semasio.net
uipglob.semasio.net
1 KB
2 w55c.net
pm.w55c.net
2 KB
2 tribalfusion.com
a.tribalfusion.com
s.tribalfusion.com
1 KB
2 de17a.com
d5p.de17a.com
637 B
2 indexww.com
js-sec.indexww.com
2 KB
2 aralego.net
cdn.aralego.net
2 KB
2 smartadserver.com
rtb-csync.smartadserver.com
2 KB
2 gumgum.com
g2.gumgum.com
rtb.gumgum.com
1 KB
2 districtm.io
dmx.districtm.io
cdn.districtm.io
431 B
2 rlcdn.com
id.rlcdn.com
api.rlcdn.com
269 B
2 readefined.com
hooks.readefined.com
content.readefined.com
10 KB
2 youtube.com
www.youtube.com
39 KB
1 brand-display.com
dmp.brand-display.com
334 B
1 extend.tv
sync.extend.tv
546 B
1 deepintent.com
match.deepintent.com
124 B
1 exelator.com
loadm.exelator.com
641 B
1 playground.xyz
ads.playground.xyz
484 B
1 bidtheatre.com
match.adsby.bidtheatre.com
550 B
1 dotomi.com
pubmatic-match.dotomi.com
104 B
1 turn.com
ad.turn.com
518 B
1 simpli.fi
um.simpli.fi
611 B
1 zeotap.com
mwzeom.zeotap.com
596 B
1 adgrx.com
cm.adgrx.com
408 B
1 erne.co
green.erne.co
325 B
1 adition.com
dsp.adfarm1.adition.com
501 B
1 criteo.com
dis.criteo.com
284 B
1 brealtime.com
biddr.brealtime.com
1 KB
1 id5-sync.com
id5-sync.com
1 KB
1 a-mo.net
prebid.a-mo.net
164 B
1 360yield.com
ice.360yield.com
521 B
1 sharethrough.com
btlr.sharethrough.com
120 B
1 gannettdigital.com
traxex.gannettdigital.com
202 B
1 wibbitz.com
cdn4.wibbitz.com
1 matheranalytics.com
js.matheranalytics.com
1 ntv.io
s.ntv.io
102 KB
0 crwdcntrl.net Failed
sync.crwdcntrl.net Failed
454 86
Domain Requested by
35 bloximages.newyork1.vip.townnews.com www.southbendtribune.com
29 tpc.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.southbendtribune.com
cdn.ampproject.org
confiant-integrations.global.ssl.fastly.net
24 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.southbendtribune.com
confiant-integrations.global.ssl.fastly.net
19 cm.g.doubleclick.net 15 redirects u.openx.net
eus.rubiconproject.com
eu-u.openx.net
19 pagead2.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.googletagservices.com
18 www.southbendtribune.com www.southbendtribune.com
bloximages.newyork1.vip.townnews.com
16 match.prod.bidr.io 16 redirects
16 ib.adnxs.com 8 redirects storage.googleapis.com
df80k0z3fi8zg.cloudfront.net
acdn.adnxs.com
15 bluellipse.advertserve.com www.civicscience.com
bluellipse.advertserve.com
14 simage2.pubmatic.com 1 redirects image6.pubmatic.com
ads.pubmatic.com
14 www.googletagservices.com www.southbendtribune.com
securepubads.g.doubleclick.net
d3lcz8vpax4lo2.cloudfront.net
13 fonts.gstatic.com fonts.googleapis.com
12 x.yieldlift.com storage.googleapis.com
11 match.adsrvr.org 7 redirects u.openx.net
eus.rubiconproject.com
eu-u.openx.net
ssum-sec.casalemedia.com
11 d2zqfs55y95cft.cloudfront.net www.southbendtribune.com
www.civicscience.com
d2zqfs55y95cft.cloudfront.net
10 image2.pubmatic.com 2 redirects image6.pubmatic.com
ads.pubmatic.com
10 cdn.ampproject.org securepubads.g.doubleclick.net
10 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.southbendtribune.com
8 includemodal.com www.southbendtribune.com
8 eu-u.openx.net 3 redirects u.openx.net
df80k0z3fi8zg.cloudfront.net
eu-u.openx.net
8 us-u.openx.net 2 redirects u.openx.net
eu-u.openx.net
7 www.civicscience.com 1 redirects www.civicscience.com
7 fonts.googleapis.com www.southbendtribune.com
d2zqfs55y95cft.cloudfront.net
www.gannett-cdn.com
securepubads.g.doubleclick.net
6 sync.1rx.io 6 redirects
6 c.amazon-adsystem.com www.southbendtribune.com
c.amazon-adsystem.com
d3lcz8vpax4lo2.cloudfront.net
5 dsum-sec.casalemedia.com 1 redirects ssum-sec.casalemedia.com
5 x.bidswitch.net 5 redirects
5 sync.go.sonobi.com 2 redirects
5 pixel.rubiconproject.com 2 redirects eus.rubiconproject.com
5 sync.mathtag.com 5 redirects
5 c1.adform.net 5 redirects
5 www.gannett-cdn.com www.southbendtribune.com
www.gannett-cdn.com
5 aax-eu.amazon-adsystem.com 1 redirects c.amazon-adsystem.com
aax-eu.amazon-adsystem.com
u.openx.net
eus.rubiconproject.com
5 www.google.com www.southbendtribune.com
5 adservice.google.de survey.g.doubleclick.net
securepubads.g.doubleclick.net
confiant-integrations.global.ssl.fastly.net
5 stats.g.doubleclick.net www.google-analytics.com
4 pixel-sync.sitescout.com 4 redirects
4 cs.emxdgt.com 4 redirects
4 adservice.google.com securepubads.g.doubleclick.net
confiant-integrations.global.ssl.fastly.net
4 htlb.casalemedia.com storage.googleapis.com
df80k0z3fi8zg.cloudfront.net
4 tag.1rx.io storage.googleapis.com
df80k0z3fi8zg.cloudfront.net
4 ap.lijit.com storage.googleapis.com
df80k0z3fi8zg.cloudfront.net
4 ssc.33across.com storage.googleapis.com
df80k0z3fi8zg.cloudfront.net
4 sync-tm.everesttech.net 4 redirects
4 token.rubiconproject.com 3 redirects eus.rubiconproject.com
4 eus.rubiconproject.com aax-eu.amazon-adsystem.com
eus.rubiconproject.com
df80k0z3fi8zg.cloudfront.net
4 www.googletagmanager.com www.southbendtribune.com
www.googletagmanager.com
3 pixel.tapad.com 2 redirects image6.pubmatic.com
3 ssum-sec.casalemedia.com 1 redirects js-sec.indexww.com
ssum-sec.casalemedia.com
3 sync.targeting.unrulymedia.com 3 redirects
3 bh.contextweb.com 3 redirects
3 confiant-integrations.global.ssl.fastly.net d3lcz8vpax4lo2.cloudfront.net
confiant-integrations.global.ssl.fastly.net
3 os4m-d.openx.net storage.googleapis.com
3 storage.googleapis.com ads3.mthsense.com
3 pixel.quantserve.com 3 redirects
3 ads3.mthsense.com securepubads.g.doubleclick.net
3 trc-events.taboola.com www.southbendtribune.com
3 sb.scorecardresearch.com 1 redirects cdn.taboola.com
www.southbendtribune.com
3 jadserve.postrelease.com s.ntv.io
www.southbendtribune.com
3 www.google.de www.southbendtribune.com
3 survey.g.doubleclick.net www.southbendtribune.com
survey.g.doubleclick.net
2 s.amazon-adsystem.com 1 redirects ssum-sec.casalemedia.com
2 pool.admedo.com 2 redirects
2 ups.analytics.yahoo.com 2 redirects
2 visitor.fiftyt.com 2 redirects
2 uipglob.semasio.net 1 redirects ads.pubmatic.com
2 pm.w55c.net 2 redirects
2 d5p.de17a.com 2 redirects
2 pr-bh.ybp.yahoo.com 1 redirects ads.pubmatic.com
2 sync.aralego.com 2 redirects
2 js-sec.indexww.com df80k0z3fi8zg.cloudfront.net
ssum-sec.casalemedia.com
2 ads.pubmatic.com df80k0z3fi8zg.cloudfront.net
ads.pubmatic.com
2 cdn.aralego.net df80k0z3fi8zg.cloudfront.net
cdn.aralego.net
2 rtb-csync.smartadserver.com 2 redirects
2 event.insticator.com d3lcz8vpax4lo2.cloudfront.net
2 u.openx.net 1 redirects aax-eu.amazon-adsystem.com
2 trc.taboola.com 1 redirects cdn.taboola.com
2 cdn.taboola.com www.southbendtribune.com
cdn.taboola.com
2 www.youtube.com www.southbendtribune.com
www.youtube.com
1 dmp.brand-display.com 1 redirects
1 sync.extend.tv 1 redirects
1 match.deepintent.com ssum-sec.casalemedia.com
1 loadm.exelator.com 1 redirects
1 rtb.gumgum.com 1 redirects
1 secure.adnxs.com 1 redirects
1 ads.playground.xyz 1 redirects
1 match.adsby.bidtheatre.com 1 redirects
1 pubmatic-match.dotomi.com ads.pubmatic.com
1 ad.turn.com 1 redirects
1 image4.pubmatic.com ads.pubmatic.com
1 um.simpli.fi ads.pubmatic.com
1 aud.pubmatic.com ads.pubmatic.com
1 mwzeom.zeotap.com ads.pubmatic.com
1 match.taboola.com image6.pubmatic.com
1 s.tribalfusion.com image6.pubmatic.com
1 a.tribalfusion.com 1 redirects
1 cm.adgrx.com image6.pubmatic.com
1 green.erne.co 1 redirects
1 dsp.adfarm1.adition.com 1 redirects
1 dis.criteo.com image6.pubmatic.com
1 image6.pubmatic.com ads.pubmatic.com
1 acdn.adnxs.com df80k0z3fi8zg.cloudfront.net
1 cdn.districtm.io df80k0z3fi8zg.cloudfront.net
1 ssc-cms.33across.com df80k0z3fi8zg.cloudfront.net
1 biddr.brealtime.com df80k0z3fi8zg.cloudfront.net
1 api.rlcdn.com df80k0z3fi8zg.cloudfront.net
1 id5-sync.com df80k0z3fi8zg.cloudfront.net
1 edfb28179cb35161b9812e7370c51d1f.safeframe.googlesyndication.com confiant-integrations.global.ssl.fastly.net
1 dh014lg6uwepv.cloudfront.net www.southbendtribune.com
1 prebid.a-mo.net df80k0z3fi8zg.cloudfront.net
1 hb.aralego.com df80k0z3fi8zg.cloudfront.net
1 insticator-d.openx.net df80k0z3fi8zg.cloudfront.net
1 apex.go.sonobi.com df80k0z3fi8zg.cloudfront.net
1 hb.emxdgt.com df80k0z3fi8zg.cloudfront.net
1 g2.gumgum.com df80k0z3fi8zg.cloudfront.net
1 dmx.districtm.io df80k0z3fi8zg.cloudfront.net
1 ice.360yield.com df80k0z3fi8zg.cloudfront.net
1 fastlane.rubiconproject.com df80k0z3fi8zg.cloudfront.net
1 hbopenbid.pubmatic.com df80k0z3fi8zg.cloudfront.net
1 df80k0z3fi8zg.cloudfront.net d3lcz8vpax4lo2.cloudfront.net
1 b2c.insticator.com d3lcz8vpax4lo2.cloudfront.net
1 geoip.insticator.com d3lcz8vpax4lo2.cloudfront.net
1 d3lcz8vpax4lo2.cloudfront.net d2na2p72vtqyok.cloudfront.net
1 d2s8wlbatk24s7.cloudfront.net d3oi8laqsvc6ey.cloudfront.net
1 d2na2p72vtqyok.cloudfront.net www.southbendtribune.com
1 d3oi8laqsvc6ey.cloudfront.net securepubads.g.doubleclick.net
1 c4981dc7ca65972f929725d0e6576531.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 454e894052a987406f58c9202386c9c1.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 aa8bde3daec928214ee0de2ce0048e90.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 btlr.sharethrough.com storage.googleapis.com
1 id.rlcdn.com eus.rubiconproject.com
1 cookiex.ngd.yahoo.com eus.rubiconproject.com
1 ads.yahoo.com 1 redirects
1 pixel-eu.rubiconproject.com 1 redirects
1 traxex.gannettdigital.com www.gannett-cdn.com
1 4d99f37e7c8dc25469e4f8c942572412.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 content.readefined.com www.southbendtribune.com
1 cdn4.wibbitz.com bloximages.newyork1.vip.townnews.com
1 hooks.readefined.com www.googletagmanager.com
1 js.matheranalytics.com www.southbendtribune.com
1 s.ntv.io www.googletagmanager.com
1 ampcid.google.de www.google-analytics.com
1 ampcid.google.com www.google-analytics.com
0 sync.crwdcntrl.net Failed
454 144
Subject Issuer Validity Valid
southbendtribune.com
R3
2021-01-05 -
2021-04-05
3 months crt.sh
bloximages.chicago2.vip.townnews.com
GeoTrust RSA CA 2018
2020-02-25 -
2021-04-25
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.google.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.google.de
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.g.doubleclick.net
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
c.amazon-adsystem.com
Amazon
2020-08-04 -
2021-08-02
a year crt.sh
upload.video.google.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.cloudfront.net
DigiCert Global CA G2
2020-05-26 -
2021-04-21
a year crt.sh
*.ntv.io
DigiCert SHA2 Secure Server CA
2021-01-25 -
2022-02-01
a year crt.sh
js.matheranalytics.com
Sectigo RSA Domain Validation Secure Server CA
2019-04-04 -
2021-04-03
2 years crt.sh
readefined.com
Amazon
2021-02-15 -
2022-03-15
a year crt.sh
www.google.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
www.google.de
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.gstatic.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.postrelease.com
Amazon
2021-01-28 -
2022-02-26
a year crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1
2020-11-25 -
2021-12-26
a year crt.sh
*.wibbitz.com
DigiCert SHA2 Secure Server CA
2020-03-28 -
2022-05-18
2 years crt.sh
*.civicscience.com
Sectigo RSA Domain Validation Secure Server CA
2020-05-06 -
2021-05-10
a year crt.sh
sb.scorecardresearch.com
DigiCert Secure Site ECC CA-1
2020-07-17 -
2021-06-02
a year crt.sh
*.advertserve.com
Go Daddy Secure Certificate Authority - G2
2018-01-05 -
2021-04-04
3 years crt.sh
*.googleusercontent.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
aax-eu.amazon-adsystem.com
Amazon
2020-06-15 -
2021-06-15
a year crt.sh
ads3.mthsense.com
Go Daddy Secure Certificate Authority - G2
2020-11-03 -
2021-11-03
a year crt.sh
usatoday.com
R3
2021-02-10 -
2021-05-11
3 months crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1
2021-01-05 -
2022-01-18
a year crt.sh
*.openx.net
GeoTrust RSA CA 2018
2020-06-18 -
2021-08-17
a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
gannettdigital.com
R3
2021-02-03 -
2021-05-04
3 months crt.sh
*.ads.yahoo.com
DigiCert SHA2 High Assurance Server CA
2021-02-09 -
2021-03-09
a month crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2020-04-14 -
2021-04-23
a year crt.sh
*.storage.googleapis.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA
2019-10-01 -
2021-09-30
2 years crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2
2020-03-11 -
2021-05-10
a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
*.1rx.io
Sectigo RSA Domain Validation Secure Server CA
2019-06-28 -
2021-06-27
2 years crt.sh
*.yieldlift.com
Amazon
2021-01-30 -
2022-02-27
a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2020-03-02 -
2021-04-01
a year crt.sh
*.sharethrough.com
Amazon
2020-09-09 -
2021-10-11
a year crt.sh
misc-sni.google.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
includemodal.com
Amazon
2020-11-15 -
2021-12-14
a year crt.sh
*.insticator.com
Sectigo RSA Organization Validation Secure Server CA
2020-08-24 -
2021-08-24
a year crt.sh
*.freetls.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2020-04-21 -
2021-04-22
a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1
2020-12-07 -
2021-12-14
a year crt.sh
*.360yield.com
Amazon
2020-08-26 -
2021-09-26
a year crt.sh
districtm.io
Cloudflare Inc ECC CA-3
2020-07-01 -
2021-07-01
a year crt.sh
*.gumgum.com
Amazon
2020-07-03 -
2021-08-03
a year crt.sh
*.emxdgt.com
Amazon
2020-07-31 -
2021-08-30
a year crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2
2020-12-06 -
2022-01-07
a year crt.sh
*.aralego.com
Sectigo RSA Domain Validation Secure Server CA
2019-09-23 -
2021-11-21
2 years crt.sh
*.a-mo.net
R3
2021-01-11 -
2021-04-11
3 months crt.sh
*.id5-sync.com
R3
2020-12-26 -
2021-03-26
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-07-19 -
2021-07-19
a year crt.sh
*.brealtime.com
Go Daddy Secure Certificate Authority - G2
2020-01-22 -
2022-03-22
2 years crt.sh
cdn.adnxs.com
GlobalSign CloudSSL CA - SHA256 - G3
2020-10-29 -
2021-04-14
5 months crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2021-01-30 -
2021-04-28
3 months crt.sh
public1.adgear.com
Sectigo RSA Domain Validation Secure Server CA
2020-09-09 -
2021-03-23
6 months crt.sh
*.tapad.com
DigiCert SHA2 Secure Server CA
2020-10-05 -
2021-11-06
a year crt.sh
*.semasio.net
Sectigo ECC Domain Validation Secure Server CA
2020-03-09 -
2021-03-27
a year crt.sh
*.simpli.fi
DigiCert SHA2 Secure Server CA
2019-09-18 -
2021-12-12
2 years crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2020-10-30 -
2021-04-27
6 months crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018
2019-06-19 -
2021-08-31
2 years crt.sh
s.amazon-adsystem.com
Amazon
2020-08-28 -
2021-08-20
a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2
2020-04-09 -
2022-06-08
2 years crt.sh

This page contains 47 frames:

Primary Page: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Frame ID: AAEE5EA5F292BF770FE0520A4DEF49DC
Requests: 136 HTTP requests in this frame

Frame: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Frame ID: 5818FFDB7D6CCF88E50B5470EACE9A51
Requests: 15 HTTP requests in this frame

Frame: https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw.5.3.2.css?pv=5.3.2
Frame ID: 175B7A78EDF589E9A47702E84DC996FC
Requests: 6 HTTP requests in this frame

Frame: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5&dcc=t
Frame ID: B32AC5E5F7C1AAB28B691FA69A84CF40
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst0wtfeMwosIYho_1ZnoyeUhYvTAvt1ff7KjvjTC2DEiprundrLMIMMUBC3qjgl3a6UM2LoW7YYXah_LEDkxV6oc4Kt-OSASpXdq9tF_-RWP09ppp6Uz3p0_1H8YKFoqWwTJC5aFuo3E4zz8Jhi4O9tRdTRBbQnmf54uy6th6sHl5ISUHuos0AEhpjTk_rE4LD1XCdI-ptp9RlYlUAJhj8_WXXOSnxBLj1rVqEOsPBMLeT6vwX9_91IhcfiH0rjzYmsr4l-QTHrmI-AUtHGjzvwCnVxL5ZaoadCA_4SIhrL5kK2qZY4SGEFE47ntNp2bnJO6Oqedn9lWw&sai=AMfl-YQh9SzNrQBHXaeBJ3yz3V49h9s1MyhJMoqhUKKhnHQUtG5-ReScw74ucxn-ESrLpJwVMytOQg3bgBEWqMeU0Z2mTcTfxva9mQVc1X_pjg5BUKY_dEYAxEYMA_QFZSQW&sig=Cg0ArKJSzJfeLbyPrPNDEAE&urlfix=1&adurl=
Frame ID: 279B0291A920CB7772A35E9B087F62D9
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvUIs3zyy1g1bZvB3fqo1jKYrCqlVKX6bhZZ4_PTwo10CVa6visFG8BunLA-Y3RCRW5IMzOfnkZhp582J1AQGpe9O9qhdN9TXn_kUvxplUlXlJRSM9Z6cbp8jles7HOezNy2T2nT680klv1nnzP8vm_NLl4AjOOsc8og_XbYBPL9X1X_Wyv5Pcpc-L7Bq9gHVmpDmhSCjvBxpOnjk8S31ttdKL99rwhZghjOR-D2Nj7Fk7KNUEQTK14vhalEfTFQS6cT92ntLPpJ0HpGH_HmJJoAVRPM1ov30pRNuVTlkqqHcx3a_GfS6oGPJfXSdRYo5ZSJSdz4wcrvw&sai=AMfl-YSqQ2ZmD6Cq3TO8nXnsf-Yki-xvVPrzhSEZne6gaDzc8p2kXZnb7JfyhCDYL7Frebyn3-s7lilfZuwvywsRU1Yoz2E1ola7GijCJBVdVVgqUPSVgAksVcbe8GsHcEp8&sig=Cg0ArKJSzP-Q09ssvDTVEAE&urlfix=1&adurl=
Frame ID: FBE5CCA49A066C8D3389BE942A6FB0F4
Requests: 5 HTTP requests in this frame

Frame: https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
Frame ID: 9E1660F96F79D9B6E27BDE975443F146
Requests: 10 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstNzoyd5wfyXGjW-srT0WUQAr4ySn27y7bVOJG4cFVuh8Q4Nfwzo0SVCe6IJ-gjMeamfNb6Ipd8CtQbEJFBfDHWjEkesjY5Gh0N3OKqw1ew80gurpT2OT-6MV3ju50OCX41ZtTMKkYvmAeiMLTSPQjEU1JZ3B6TvZUAMYUhW2Dtrc5sINTFPIkK_l01UFZIgI0Vo4mV25uyqbYdd-j8MbTZXrlgDPweQkWAnb_ygRNyRy-3kywiO4LmIni9JscGX6-LRQHQl7pMYxGTQUnVWyig7EBXwHiLwr0ht83HoOHVl_Pl7JFbeb_1D3R-aiLCPqZ7eTRYy3rHWw&sai=AMfl-YSLe0ou5oAE3-W2zYwKIob5E7ikJzueA0Z7Hh4SgT1ImEK7s-nmVLJrH5yo1-3jj9C71mbQp35QiFrqe9-F0aT7FxW8w6KHUi8p_aVtya7JyziyKyboJ6ZZS8KFO4X1&sig=Cg0ArKJSzPGZ0OOWTMPXEAE&urlfix=1&adurl=
Frame ID: 9459F71BF5B7C053251AE95355C64E71
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvoDuVDYP0g2wn1EEGPakCTfO-wYSppyBaVsNybwI_V-pTGiq4NzdIqZY2NvwDcgMoqHuJIz-43715pgYMYznqlBRvGcl0tCbEO8MvYfac3-2TPkwhTkEy2V7_OKEbOge6RkNOus3WIoEykMoKZK7IgdB3_NpAxqeslVjTlohTidrm6dqrimfC1aRONO8jSvSIhaZQZiJ2nwmPWdVONcOt31u-Wq6Xd-OHvC1LELl5YBi3Yhvs8rmOe9NJn8UcNQGQH25nX3YI5NAcOKXFgoaNEJ2YszzPvnxbas0ZHFMAtg2kHXbacWg2A-mM_gNo88_XRO7OuMpPZVw&sai=AMfl-YQX6x4pzBgZyxCY3KYHIfvQ7bED7ZYZbf7wDTjEy5f2Kch693LEQImGJzjemfuuyJKY6r5YM7efBBOFreJDnBtK3TGo0tup6TTlnQv89aFRBzeIVOQPUZANoMKqBJGR&sig=Cg0ArKJSzJOzyE9mW90-EAE&urlfix=1&adurl=
Frame ID: 1EB686AE15E88C4680269DAFBDE41362
Requests: 5 HTTP requests in this frame

Frame: https://aax-eu.amazon-adsystem.com/s/v3/pr?exlist=rbd_ox-db5&fv=1.0&a=cm&cm3ppd=1
Frame ID: E68CB84625A6E6A85D6C1A0A4039E330
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Frame ID: B3F9EA1B3BDC4661E72BE44F6F76612F
Requests: 12 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Frame ID: C05949BDDCC2EE29D51173B67B12DD8F
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: EBA409D1875C39A3B6FB4F9406FBC8F7
Requests: 2 HTTP requests in this frame

Frame: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Frame ID: 359535CC532B71431B159317CDF226DD
Requests: 24 HTTP requests in this frame

Frame: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Frame ID: 895AF2CC80D018E6A502FED4C6CD79A7
Requests: 19 HTTP requests in this frame

Frame: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Frame ID: 5A08C0031C15DF6B0F2566F8EF3A5863
Requests: 25 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 79A5DD30795AC54FAB704CC25B82252E
Requests: 2 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs
Frame ID: 491B52333E05AA48DF28C42059CF8BC7
Requests: 17 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 024078282AAB115F5EB79C90BFC6CECA
Requests: 2 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs
Frame ID: 30310D27BAE4A2568021207D65F318AD
Requests: 18 HTTP requests in this frame

Frame: https://d3oi8laqsvc6ey.cloudfront.net/pw.js
Frame ID: 5C2696EFED40A6ED56BDDCCD055D8D30
Requests: 61 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 3FFB9A91C7A12417DDFFACEDDB5E0873
Requests: 2 HTTP requests in this frame

Frame: https://b2c.insticator.com/v3/pages/usertracking
Frame ID: F5BCC4740C66EFBF4F24BC64A4DC5CA2
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstgU4W6dO-RHzg1fW9A7LAixM-BiX4pGe4LxlH_COjE_aeAxAdilpoZhtcWgrZcv8kOcWKrgeCcA_2eBrDZesGyGRTui1ngOGm-VjlPxW0jxqez5htodoLK7GUPpTYFkvYrSmGTvFK-d_otpJ02pTAADkn3nJYCJDwC5gD7eyCqvadWMt1ruJzGaE02DZUzDFrbu6xg214TL4vomihEL1nWBsSiAzDLyuFURV4d8VY_0JR9qPDBohXjdgDifX3PIgS7vPnWsga8iGZI15nbYFCuU7wx05RTG1qrsHIwTHK7_uRAGt59Rn3EiNVV9je2sBs&sig=Cg0ArKJSzOphWx0kbrj2EAE&adurl=
Frame ID: 55ED5F5A66B78F237EB84AFAF25B7ECD
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 840ECB5A0F22D139DE07994D9779BB2D
Requests: 2 HTTP requests in this frame

Frame: https://cdn.aralego.net/ucfad/cookie/sync.html
Frame ID: 1E7B8E5941972B01B2245DA31677FF8D
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 4F9CD59F24C818F9CB15A12E6FB1F2BA
Requests: 2 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
Frame ID: 28921A3810F05993B9491771C66F8F69
Requests: 7 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 737EB845804E7A4D0562BDC2EF36F91E
Requests: 24 HTTP requests in this frame

Frame: https://biddr.brealtime.com/check.html
Frame ID: A902593E01D69ADB540ACB88D3085758
Requests: 1 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=avHmsEZx0r6ikSaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
Frame ID: 20F2F7E8B728737ED8260800EA1E9698
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: BCAAEB1A2FADB38B40BB0E43D71F95BB
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 558F8BBD8ADC52E42E6B456D14092A39
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 0BAC0C12234DE3AA8AA4073FFAF1B4F2
Requests: 3 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Frame ID: 1608BAC7D0D75A157B7FA1D424C50F5A
Requests: 10 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: B937D1920665CE87FAD65846791226BC
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7529919757327060848
Frame ID: FBA43DB070E10B5C9AA384D143597082
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAGsoU7AYpMAAA_m7fI3SQ
Frame ID: 41C0B5E51B31B7D6CA6C57DA7E314CCF
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6931402102749329547
Frame ID: CF929175A14342B66A40EF77403760D6
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=uB3IFrotXcNG9hq0iT7pWWak
Frame ID: B4EFB0EFF84C6CD30A8594082DCDC205
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-52d658b2-8768-453b-aa8a-5369803162ab-003
Frame ID: 9CEFEEBAD31F171D7C915A739511FA3C
Requests: 1 HTTP requests in this frame

Frame: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Frame ID: 055862B292081A2A84DCE9CD2E4EAAB5
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: 75BE715FED03C3749C5B0A3E8B707F68
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=e01vBY3QMtAJ&pid=557219
Frame ID: E1A51E27C3C9508BFE326C1DD4DBD9CA
Requests: 1 HTTP requests in this frame

Frame: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=e6135727-3e8a-4b77-b9ea-515aee9d0c55-tuct72acefe&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Frame ID: DBF5278F86214C96F7784B292FA6CEAE
Requests: 1 HTTP requests in this frame

Frame: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
Frame ID: C083660ACBCD996BCA75A77858BE7B1F
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:QKncBT1X1LdweO5&gdpr=0&gdpr_consent=
Frame ID: AF0CA2B2713D15AF6226F3EBABA5E146
Requests: 1 HTTP requests in this frame

Screenshot


Page Statistics

454
Requests

98 %
HTTPS

30 %
IPv6

86
Domains

144
Subdomains

102
IPs

10
Countries

4534 kB
Transfer

10439 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51
  • https://www.civicscience.com/jspoll/4/civicscience-widget.js HTTP 302
  • https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-polyfills.js
Request Chain 108
  • https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1613842801907&ns_c=UTF-8&cv=3.5&c8=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&c7=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1613842801907&ns_c=UTF-8&cv=3.5&c8=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&c7=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&c9=&cs_ak_ss=1
Request Chain 150
  • https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5 HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5&dcc=t
Request Chain 170
  • https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D HTTP 302
  • https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Request Chain 176
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=REXFlEZMwZFfFpOdShDbnEdNzpJfR5WRQBCSUqoU
Request Chain 177
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=5817131199769861046
Request Chain 180
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPVvRUEdcKBLG3CZl_64usc&google_cver=1
Request Chain 191
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=a9eu HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/ecm3?id=KLE0C5XF-8-A3SZ&ex=d-rubiconproject.com&status=ok
Request Chain 192
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S0xFMEM1WEYtOC1BM1Na
Request Chain 193
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KLE0C5XF-8-A3SZ&sigv=1&esig=2~c383b552c8d999ae1dea1a614121dc2908e9206d HTTP 302
  • https://cookiex.ngd.yahoo.com/ack?xid=E0&eid=KLE0C5XF-8-A3SZ
Request Chain 195
  • https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmNkZmMyMTExMGM2Y2ZjOWZkMjZkYmEwOTdmYTFlNjk5ZTU3ZGQ1ZA
Request Chain 196
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=fa046031-4974-4c00-b096-c7a8abf87be8
Request Chain 197
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEAVeQwrJOHhDYBuMPayEVww&google_cver=1
Request Chain 198
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&_test=YDFJdQAAALzdOjoG HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YDFJdQAAALzdOjoG&_test=YDFJdQAAALzdOjoG
Request Chain 373
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=51113032-2363-4e94-85a5-f312b07cd114&gdpr=0 HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=fa046031-4974-4c00-b096-c7a8abf87be8
Request Chain 374
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=51113032-2363-4e94-85a5-f312b07cd114&gdpr=0 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/ox HTTP 303
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFENGJFN0FZcE1BQUJBS1duQ2tOdw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAD4bE7AYpMAABAKWnCkNw&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpp%252Cox%26bee_sync_current_partner%3Dpm%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2&_bee_ppp=1 HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAAcsU7AYpMAABD5HCqdPw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp%2Cox&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=7403304255767454958 HTTP 303
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAGsoU7AYpMAAA_m7fI3SQ&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D7403304255767454958%26bee_sync_partners%3Dox%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?userid=7403304255767454958&bee_sync_partners=ox&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AAGsoU7AYpMAAA_m7fI3SQ&pid=558502&do=add HTTP 303
  • https://us-u.openx.net/w/1.0/sd?id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ HTTP 302
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
Request Chain 375
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fx.yieldlift.com%252Fsetuid%253Fbidder%253Dadnxs%2526gdpr%253D%2526gdpr_consent%253D%2526us_privacy%253D%2526uid%253D%2524UID HTTP 302
  • https://x.yieldlift.com/setuid?bidder=adnxs&gdpr=&gdpr_consent=&us_privacy=&uid=5108492245175821146
Request Chain 376
  • https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=&gdpr_consent=&us_privacy= HTTP 302
  • https://x.yieldlift.com/setuid?bidder=rubicon&uid=KLE0C5XF-8-A3SZ
Request Chain 377
  • https://sync.go.sonobi.com/us.gif?loc=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dsonobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%5BUID%5D HTTP 302
  • https://x.yieldlift.com/setuid?bidder=sonobi&gdpr=&gdpr_consent=&us_privacy=&uid=ecce6c49-7289-4f44-94f4-95bebfb4e207
Request Chain 378
  • https://cs.emxdgt.com/um?ssp=pbs&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Demx_digital%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24UID HTTP 302
  • https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Demx_digital%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24EMXUID HTTP 302
  • https://cs.emxdgt.com/umcheck?apnxid=421273563502918358&redirect=https://x.yieldlift.com/setuid?bidder=emx_digital&gdpr=&gdpr_consent=&us_privacy=&uid=$EMXUID HTTP 302
  • https://x.yieldlift.com/setuid?bidder=emx_digital&uid=421273563502918358brt66031613842809065503f1
Request Chain 379
  • https://sync.1rx.io/usersync2/rmphb?gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Drhythmone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%5BRX_UUID%5D HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8408571935 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8408571935 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/9179d561-553f-4cea-8fc7-7ee46a16b2f5 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003?redir=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Drhythmone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3DRX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003 HTTP 302
  • https://x.yieldlift.com/setuid?bidder=rhythmone&gdpr=&gdpr_consent=&us_privacy=&uid=RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003
Request Chain 380
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fx.yieldlift.com%252Fsetuid%253Fbidder%253Dadnxs%2526gdpr%253D%2526gdpr_consent%253D%2526us_privacy%253D%2526uid%253D%2524UID HTTP 302
  • https://x.yieldlift.com/setuid?bidder=adnxs&gdpr=&gdpr_consent=&us_privacy=&uid=421273563502918358
Request Chain 381
  • https://sync.go.sonobi.com/us.gif?loc=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dsonobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%5BUID%5D HTTP 302
  • https://x.yieldlift.com/setuid?bidder=sonobi&gdpr=&gdpr_consent=&us_privacy=&uid=ecce6c49-7289-4f44-94f4-95bebfb4e207
Request Chain 382
  • https://cs.emxdgt.com/um?ssp=pbs&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Demx_digital%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24UID HTTP 302
  • https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Demx_digital%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24EMXUID HTTP 302
  • https://cs.emxdgt.com/umcheck?apnxid=421273563502918358&redirect=https://x.yieldlift.com/setuid?bidder=emx_digital&gdpr=&gdpr_consent=&us_privacy=&uid=$EMXUID HTTP 302
  • https://x.yieldlift.com/setuid?bidder=emx_digital&uid=421273563502918358brt66031613842809065503f1
Request Chain 383
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=51113032-2363-4e94-85a5-f312b07cd114&gdpr=0 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/ox HTTP 303
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCQWJVN0FZcE1BQUFfWUJGREdvZw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABAbU7AYpMAAA_YBFDGog&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpp%252Cox%26bee_sync_current_partner%3Dpm%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2&_bee_ppp=1 HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAGsoU7AYpMAAA_m7fI3SQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp%2Cox&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=5540819673863955520 HTTP 303
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAGsoU7AYpMAAA_m7fI3SQ&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D5540819673863955520%26bee_sync_partners%3Dox%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?userid=5540819673863955520&bee_sync_partners=ox&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AAGsoU7AYpMAAA_m7fI3SQ&pid=558502&do=add HTTP 303
  • https://us-u.openx.net/w/1.0/sd?id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ HTTP 302
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
Request Chain 384
  • https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=&gdpr_consent=&us_privacy= HTTP 302
  • https://x.yieldlift.com/setuid?bidder=rubicon&uid=KLE0C5XF-8-A3SZ
Request Chain 385
  • https://sync.1rx.io/usersync2/rmphb?gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Drhythmone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%5BRX_UUID%5D HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3978949281 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/9179d561-553f-4cea-8fc7-7ee46a16b2f5 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003?redir=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Drhythmone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3DRX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003 HTTP 302
  • https://x.yieldlift.com/setuid?bidder=rhythmone&gdpr=&gdpr_consent=&us_privacy=&uid=RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003
Request Chain 397
  • https://id5-sync.com/s/441/9.gif?puid=e_9f2ff663-d351-45c7-8758-4bbbef1b23b8&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/441/441/9/1.gif?puid=e_9f2ff663-d351-45c7-8758-4bbbef1b23b8&gdpr=0&gdpr_consent= HTTP 302
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/441/2/8/2.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fid5-sync.com%2Fc%2F441%2F2%2F8%2F2.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/441/2/8/2.gif?puid=6441404401232087858&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-ZHMOh8xJXdV2gDtTpUvZJm_2Z1SGigNjpmPyAspyqw&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F3%2F7%2F3.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/441/3/7/3.gif?puid=b37c6031-497d-4800-8d97-293bd35ac316&gdpr=0&gdpr_consent= HTTP 302
  • https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOh8xJXdV2gDtTpUvZJm_2Z1SGigNjpmPyAspyqw&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F441%2F124%2F6%2F4.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://ice.360yield.com/ul_cb/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOh8xJXdV2gDtTpUvZJm_2Z1SGigNjpmPyAspyqw&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F441%2F124%2F6%2F4.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/cq/441/124/6/4.gif?puid=e5573f39-3258-4835-9f7c-d45881ae881f&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
  • https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F203%2F5%2F5.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/441/203/5/5.gif?puid=b806803f-9a6a-4e47-8cfb-7ed85cb1ee7b&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/264.gif?puid=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&ttl=%%TTL%% HTTP 302
  • https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F10%2F3%2F7.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
  • https://id5-sync.com/c/441/10/3/7.gif?puid=6532640163108253535&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/441/19/2/8.gif?puid=${profile_id}&gdpr=0&gdpr_consent=
Request Chain 398
  • https://x.bidswitch.net/sync?ssp=sonobi HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=sonobi HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=sonobi&bsw_param=1736acce-807e-4e73-9457-815dd0dce810&google_hm=MTczNmFjY2UtODA3ZS00ZTczLTk0NTctODE1ZGQwZGNlODEw HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEFChpNKQrKVfAmeWpRFXVAg&google_cver=1&ssp=sonobi&bsw_param=1736acce-807e-4e73-9457-815dd0dce810 HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=1736acce-807e-4e73-9457-815dd0dce810
Request Chain 399
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=e315a43aa9&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=e315a43aa9&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=td&nuid=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&pubid=e315a43aa9
Request Chain 400
  • https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID] HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=74786031-497d-4f00-8f0b-c8c096348434
Request Chain 401
  • https://sync.aralego.com/idsync HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/ucfunnel/56f308f4-9837-3268-bd0a-4d3a3c79d777?gdpr=0&euconsent= HTTP 302
  • https://sync.aralego.com/idsync?ucf_nid=dsp-AE38A6E4BB372DE1838A748E89487D9&ucf_user_id=y-N1NuXTR1lwKg5bY0hKhOqty8DGvoxmBT36v_KTM-&redirect= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=aralego&google_hm=NTZmMzA4ZjQtOTgzNy0zMjY4LWJkMGEtNGQzYTNjNzlkNzc3&google_redir=https%3A%2F%2Fcdn.aralego.net%2Fimg%2F1x1.png HTTP 302
  • https://cdn.aralego.net/img/1x1.png
Request Chain 403
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=b37c6031-497d-4800-8d97-293bd35ac316
Request Chain 404
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=8zBXUvE5UwfoOQBRozNJUPJiV1boOVUC8jktVRM-
Request Chain 405
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6532640163108253535
Request Chain 407
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Yjk0ZjNkNmEtNjFkOS0yOWQxLWQ5OTQtNWU0NDZjNWQzYjU5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Yjk0ZjNkNmEtNjFkOS0yOWQxLWQ5OTQtNWU0NDZjNWQzYjU5&google_tc=
Request Chain 408
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc= HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEItPvx4QYuStxX2RAM294Hg&google_cver=1
Request Chain 410
  • https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Request Chain 411
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels HTTP 307
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Request Chain 413
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7529919757327060848
Request Chain 414
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFHc29VN0FZcE1BQUFfbTdmSTNTUQ&bee_sync_partners=pm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAGsoU7AYpMAAA_m7fI3SQ
Request Chain 415
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6931402102749329547
Request Chain 416
  • https://green.erne.co/pubmatic/cm HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=uB3IFrotXcNG9hq0iT7pWWak
Request Chain 417
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2548470698 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-52d658b2-8768-453b-aa8a-5369803162ab-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-52d658b2-8768-453b-aa8a-5369803162ab-003 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-52d658b2-8768-453b-aa8a-5369803162ab-003
Request Chain 419
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Request Chain 420
  • https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%% HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=e01vBY3QMtAJ&pid=557219
Request Chain 421
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID HTTP 302
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=e6135727-3e8a-4b77-b9ea-515aee9d0c55-tuct72acefe&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Request Chain 422
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxODQmdGw9MTU3NjgwMA==&r=https://pixel.tapad.com/idsync/ex/receive?partner_id=PUBMATIC_RTB&partner_device_id=${PUBMATIC_UID} HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=PUBMATIC_RTB HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
Request Chain 423
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:QKncBT1X1LdweO5&gdpr=0&gdpr_consent=
Request Chain 424
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NsA5gjAcQ1uLTQg78YWXMg%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 426
  • https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=36C03982-301C-435B-8B4D-083BF1859732&sInitiator=external&gdpr=0&gdpr_consent= HTTP 302
  • https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=36C03982-301C-435B-8B4D-083BF1859732&sInitiator=external&gdpr=0&gdpr_consent=
Request Chain 427
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=36C03982-301C-435B-8B4D-083BF1859732&gdpr= HTTP 302
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=36C03982-301C-435B-8B4D-083BF1859732&gdpr=&fbounce=1 HTTP 302
  • https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=36C03982-301C-435B-8B4D-083BF1859732&addseg=31
Request Chain 428
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MzZDMDM5ODItMzAxQy00MzVCLThCNEQtMDgzQkYxODU5NzMy&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 429
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEMMuZK8QEVprTgK0VZPr0Vc&google_cver=1
Request Chain 431
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2
Request Chain 432
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=6532640163108253535
Request Chain 433
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:b37c6031-497d-4800-8d97-293bd35ac316&gdpr=0&gdpr_consent=
Request Chain 434
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6441404401232087858&gdpr=0&gdpr_consent=
Request Chain 435
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=36C03982-301C-435B-8B4D-083BF1859732&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=36C03982-301C-435B-8B4D-083BF1859732&redir=true&gdpr=0&gdpr_consent=&verify=true HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-NJaiA0l1l2INTa5594MujLzM.woSCzg-&gdpr=0&gdpr_consent=
Request Chain 437
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=1736acce-807e-4e73-9457-815dd0dce810 HTTP 302
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=1736acce-807e-4e73-9457-815dd0dce810 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=304d697b-9cce-4dfd-b27a-ff3b79d79051&user_group=1&ssp=pubmatic&bsw_param=1736acce-807e-4e73-9457-815dd0dce810 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1736acce-807e-4e73-9457-815dd0dce810&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 438
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA
Request Chain 439
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8546845238932743443&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 440
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YDFJfQAAAKw__zoG HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YDFJfQAAAKw__zoG&gdpr=0&gdpr_consent=&_test=YDFJfQAAAKw__zoG
Request Chain 441
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=745268aa-806c-4b12-bcbf-ccd9b26dc2f7-6031497e-4348&gdpr=0&gdpr_consent=
Request Chain 443
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:018b8440-f673-4ce1-81f7-9e347bcd3e8e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Request Chain 444
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=6441404401232087858
Request Chain 445
  • https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_fab5108b-b094-4e1e-b16e-c3eb7cc51eb1
Request Chain 447
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YDFJfUbucIfwI6OHlaCo9wAABL0AAAIB HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&google_gid=CAESEBQLjMYwgSiU-48j7svwid8&google_cver=1
Request Chain 448
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YDFJfUbucIfwI6OHlaCo9wAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEC_5nAQMsuUyZDler7LNgWs&google_cver=1
Request Chain 449
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&id=YDFJfUbucIfwI6OHlaCo9wAABL0AAAIB HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&id=YDFJfUbucIfwI6OHlaCo9wAABL0AAAIB&dcc=t
Request Chain 450
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48 HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=48 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=e6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3De6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348%26partner_url%3Dhttps%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D64%2526external_user_id%253De6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348%2526expiration%253D1616434814 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=e6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348&partner_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D64%26external_user_id%3De6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348%26expiration%3D1616434814 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=e6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348&expiration=1616434814
Request Chain 452
  • https://sync.extend.tv/r.gif?exchange=index HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=23b095e1-4f6a-4e23-9eed-51829c192c9b
Request Chain 453
  • https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3CIndex_user_id%3E HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=5591caa5-98f1-4063-eb623aa9

454 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request article_47a83152-829f-5896-928e-0ba21367ef33.html
www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/
220 KB
48 KB
Document
General
Full URL
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
731772885df2d8f253555edc22af58b57d3e869d5341a74b5542470c73a89515
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.southbendtribune.com
:scheme
https
:path
/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-type
text/html; charset=UTF-8
x-loop
1
referrer-policy
strict-origin-when-cross-origin
cache-control
public, max-age=300
last-modified
Mon, 12 Aug 2019 22:11:07 GMT
x-robots-tag
noarchive
x-ua-compatible
IE=edge
x-chromelogger-data
eyJ2ZXJzaW9uIjoiMS41Ni4zIiwiY29sdW1ucyI6WyJ0eXBlIiwibG9nIiwiYmFja3RyYWNlIl0sInJvd3MiOltbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvY29tcG9uZW50c1wvY29uZmlnXC9tYWNyb3NcL2NvbnN0cnVjdC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXSxbIndhcm4iLFsiY21zLnVzZXI6IE5vIHN1Y2ggdXNlcjogNTkyOTk3YTAtYjI3Ny0xMWU3LWJjNmMtZDc5YzE2NDIwNjVkIl0sIlwvdXNyXC9sb2NhbFwvc2hhcmVcL3RuY21zXC90ZW1wbGF0ZXNcL2xpYnJhcmllc1wvZmxleFwvYXBwc1wvZWRpdG9yaWFsXC9mbGV4LWVkaXRvcmlhbFwvdGVtcGxhdGVzXC9jb250ZW50LmFydGljbGUuaHRtbC51dGwiXV19
link
<https://bloximages.newyork1.vip.townnews.com>; rel=preconnect dns-prefetch; crossorigin </shared-content/art/tncms/user/user.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.6edb5af3e93b0a377ec925c5f1c6ddde.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/common.5ee3960b4d37bc106988fa535b393865.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.1477faac295a3745e4796d2263e75f11.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/application.93d1db0a57d520951552a1dcd8fd9aeb.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.navigation.accessibility.3184e9304073379bbe4e2c6500858bb1.js>; rel=preload; as=script
x-tncms
1.56.3; app6; 0.24s; 4.6M
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
x-xss-protection
1; mode=block
etag
W/b3aefeb66ec65fedd4d4ec8318e181f7
content-encoding
gzip
vary
X-IPCountry, Accept-Encoding
age
0
x-vcache
MISS
accept-ranges
bytes
content-length
43799
user.js
www.southbendtribune.com/shared-content/art/tncms/user/
6 KB
2 KB
Script
General
Full URL
https://www.southbendtribune.com/shared-content/art/tncms/user/user.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
0230e8c67f568c29bfa2d9756f6e9f79ca6a375d99cbeb54bf09c35fb9e525c4

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:38:59 GMT
content-encoding
gzip
last-modified
Thu, 18 Feb 2021 22:24:35 GMT
age
61
etag
W/"602ee923-1891"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=600
x-vcache
HIT
accept-ranges
bytes
content-length
2304
service-worker-allowed
/
jquery.min.6edb5af3e93b0a377ec925c5f1c6ddde.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/
98 KB
33 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.6edb5af3e93b0a377ec925c5f1c6ddde.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0785141e6461918363176bb595c118997a66d51af8338db5999308cd593cfebd
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Wed, 09 Sep 2020 19:56:59 GMT
cf-request-id
08621ff66a00002373b3176000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5f59338b-18813"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029d7b392373-ZRH
expires
Sun, 07 Nov 2021 05:54:30 GMT
bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/
39 KB
10 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93eac8b1fb14d0863561633dfdf563013c023393aabfb122e3be7256629d9235
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Fri, 06 Sep 2019 14:16:03 GMT
cf-request-id
08621ff66a0000237375ab8000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5d726a23-9bd8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029d7b382373-ZRH
expires
Thu, 04 Nov 2021 05:26:11 GMT
common.5ee3960b4d37bc106988fa535b393865.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/
35 KB
13 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/common.5ee3960b4d37bc106988fa535b393865.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e6c02cecdf5cb7b5db7cbf455c81c05828f2f801dd585ffdfa9d4cc90e9be1a
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Fri, 23 Oct 2020 13:08:36 GMT
cf-request-id
08621ff66a0000237376be7000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5f92d5d4-8a06"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029d7b3c2373-ZRH
expires
Fri, 05 Nov 2021 08:12:51 GMT
tnt.1477faac295a3745e4796d2263e75f11.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/
7 KB
3 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.1477faac295a3745e4796d2263e75f11.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
560357e94ad4e3f3e2199cdecaaf8d339f35d97ec03de8b875eef2bbd80b43fb
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Fri, 23 Oct 2020 13:08:14 GMT
cf-request-id
08621ff6790000237358a54000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5f92d5be-1bf3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029d8b7b2373-ZRH
expires
Fri, 05 Nov 2021 08:39:40 GMT
application.93d1db0a57d520951552a1dcd8fd9aeb.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/
4 KB
1 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/application.93d1db0a57d520951552a1dcd8fd9aeb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7c4e85fab99165f7d8a912f21ae8d691b6a96049780d96e174e6394e09384ca
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Thu, 05 Nov 2020 18:39:33 GMT
cf-request-id
08621ff66a0000237396873000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fa446e5-f5b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029d7b3a2373-ZRH
expires
Sun, 07 Nov 2021 06:23:19 GMT
tnt.navigation.accessibility.3184e9304073379bbe4e2c6500858bb1.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/
2 KB
915 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.navigation.accessibility.3184e9304073379bbe4e2c6500858bb1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a0eaf21fe4084cc7105e771f57731abe41a4d647a4879dea141885fcc3096b2
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Fri, 29 Jan 2021 17:55:48 GMT
cf-request-id
08621ff66d00002373a41d4000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"60144c24-925"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029d7b3f2373-ZRH
expires
Wed, 02 Feb 2022 20:01:19 GMT
bootstrap.min.44f4ed00052aeaf66307fd409db0d101.css
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/styles/
107 KB
16 KB
Stylesheet
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/styles/bootstrap.min.44f4ed00052aeaf66307fd409db0d101.css
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d584af3d0a8ad98207995400856e5e8c608551e080e252ed413e82c19ffd04f
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Fri, 23 Oct 2020 13:08:03 GMT
cf-request-id
08621ff66a000023735c9f4000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5f92d5b3-1ab8e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029d7b342373-ZRH
expires
Thu, 04 Nov 2021 09:24:24 GMT
layout.8f9ea2aebd539706f1500a18510dd6e4.css
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/styles/
130 KB
22 KB
Stylesheet
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/styles/layout.8f9ea2aebd539706f1500a18510dd6e4.css
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8753718082b7690c2605a7ea950aeceb572ef725f0ae7b347d19d5c41c6e24d
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Wed, 03 Feb 2021 17:28:05 GMT
cf-request-id
08621ff66900002373b583b000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"601add25-2073c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029d7b362373-ZRH
expires
Thu, 03 Feb 2022 18:01:16 GMT
theme-basic.0740431ec2aa31f2e7d813ea5c660a8d.css
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/themes/resources/styles/
41 KB
7 KB
Stylesheet
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/themes/resources/styles/theme-basic.0740431ec2aa31f2e7d813ea5c660a8d.css
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9e67b8aa737ee25d9afa29a6d7ffb395d2390167df4ac9c8e22c23bd372f30d
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Fri, 29 Jan 2021 17:57:46 GMT
cf-request-id
08621ff66a00002373d92a7000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"60144c9a-a4c5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029d7b372373-ZRH
expires
Wed, 02 Feb 2022 20:01:19 GMT
gtm.js
www.googletagmanager.com/
150 KB
49 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ead4ac78592cb0600d61fa1be3f49e794af59972524204e9ab4daadf62fb7dbd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
50462
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 20 Feb 2021 17:40:00 GMT
tracking.js
www.southbendtribune.com/shared-content/art/tncms/
3 KB
1 KB
Script
General
Full URL
https://www.southbendtribune.com/shared-content/art/tncms/tracking.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
f95fe1c0376aa720a01267e70fb42a259d610fa9fa66f78e7fc629f9bd835c43

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:39:16 GMT
content-encoding
gzip
last-modified
Thu, 18 Feb 2021 22:24:35 GMT
age
43
etag
W/"602ee923-a4c"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=600
x-vcache
HIT
accept-ranges
bytes
content-length
1150
service-worker-allowed
/
analytics.js
www.google-analytics.com/
46 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 05 Feb 2021 21:33:27 GMT
server
Golfe2
age
6528
date
Sat, 20 Feb 2021 15:51:12 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18980
expires
Sat, 20 Feb 2021 17:51:12 GMT
gtm.js
www.googletagmanager.com/
85 KB
32 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5MTD44X&l=dataLayer
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7623d5c146b5fc766be70e2a709128df7c53c59741d225d4d76cd33bef5cca7f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31933
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 20 Feb 2021 17:40:00 GMT
ec.js
www.google-analytics.com/plugins/ua/
3 KB
2 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 16:48:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
3082
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1306
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:48:38 GMT
publisher:getClientId
ampcid.google.com/v1/
74 B
542 B
XHR
General
Full URL
https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
ESF
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
94
x-xss-protection
0
publisher:getClientId
ampcid.google.de/v1/
3 B
471 B
XHR
General
Full URL
https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
ESF
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
23
x-xss-protection
0
collect
stats.g.doubleclick.net/j/
1 B
93 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-54716522-7&cid=380505622.1613842800&jid=795637615&gjid=807012541&_gid=1405610508.1613842800&_u=aGBAgUALAAQCAE~&z=94676278
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 20 Feb 2021 17:40:00 GMT
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
190 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j88&aip=1&a=1106062857&t=pageview&_s=1&dl=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgUALAAQC~&jid=795637615&gjid=807012541&cid=380505622.1613842800&tid=UA-54716522-7&_gid=1405610508.1613842800&gtm=2wg2a1PDQV3N&cd2=editorial&cd3=flex&cd4=flex-editorial&cd5=no&cd6=Large%3A%20Desktop%20computers.&cd8=200&cd9=No&cd10=No&cd12=No&cd13=null&cd16=No&cd17=Page%20View&cd20=47a83152-829f-5896-928e-0ba21367ef33&cm1=243&z=213686354
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 03:55:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
49463
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
subscription.js
www.southbendtribune.com/shared-content/art/tncms/
4 KB
2 KB
Script
General
Full URL
https://www.southbendtribune.com/shared-content/art/tncms/subscription.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
5c5e2a40da7134899428805cd2c7be46cd4c25404417dc4ed7075fe944a65b04

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:36:59 GMT
content-encoding
gzip
last-modified
Wed, 03 Feb 2021 00:01:54 GMT
age
180
etag
W/"6019e7f2-f2e"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=600
x-vcache
HIT
accept-ranges
bytes
content-length
1802
service-worker-allowed
/
/
www.southbendtribune.com/tncms/subscription/check_ip/
19 B
427 B
XHR
General
Full URL
https://www.southbendtribune.com/tncms/subscription/check_ip/
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/shared-content/art/tncms/subscription.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
eb19bdbb8b9d5e43ed2b6c6ca6090d31767a6c7ec0b47ddf49317c450f826624
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
X-Requested-With
XMLHttpRequest

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
content-length
39
x-xss-protection
1; mode=block
x-loop
1
referrer-policy
strict-origin-when-cross-origin
x-vcache
MISS
x-frame-options
SAMEORIGIN
vary
X-IPCountry, Accept-Encoding
content-type
application/json; charset=UTF-8
x-tncms
1.56.3; app11; 0s; 1.1M
cache-control
private, max-age=3600
accept-ranges
bytes
x-robots-tag
noarchive
tnt.access.status.828de94349981272665c0fb0107f3e49.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/subscription/resources/scripts/
927 B
426 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/subscription/resources/scripts/tnt.access.status.828de94349981272665c0fb0107f3e49.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
18e0375034d708bbd07a006a0bce3e4c5ce9aecc05952f0c4ecb05117a29cb54
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Thu, 05 Nov 2020 18:39:38 GMT
cf-request-id
08621ff7e600002373d4294000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fa446ea-39f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a029fd9eb2373-ZRH
expires
Sun, 07 Nov 2021 06:34:11 GMT
user-controls.578df3df79d812af55ab13bae47f9857.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/scripts/
517 B
763 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/scripts/user-controls.578df3df79d812af55ab13bae47f9857.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f402b2d75ac54e1c369d34b97efcedb68aa084b039ab91b85ad70ea53ebb5a3a
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Thu, 05 Nov 2020 18:39:36 GMT
cf-request-id
08621ff803000023738c847000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fa446e8-205"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a00a6c2373-ZRH
expires
Sat, 06 Nov 2021 09:49:23 GMT
gpt.js
www.googletagservices.com/tag/js/
57 KB
19 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a06af446be30cdc4a1b9c4481b813722163853b764fe4f1dcff1468662edaddd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"789 / 923 of 1000 / last-modified: 1613776162"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19523
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:00 GMT
apstag.js
c.amazon-adsystem.com/aax2/
115 KB
30 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.24.128 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
130eab0b79272570e565d77bb286b5755b9aae8f33efe8af7a2689bf8eabb859

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:33:24 GMT
content-encoding
gzip
server
Server
age
395
etag
d7c8ebbead57940cf77ae4183f7ff01a
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 384bf15c1ac91d451725d766417680b1.cloudfront.net (CloudFront)
cache-control
public, max-age=900
x-amz-cf-pop
ZAG50-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-version-id
pkiOsnrw5ub40d2SPOSAjPBBoA7O4uIM
x-amz-cf-id
DJ8bUAAzt3LvtnzDJ3_p-oZzAXB97t7mwHNW0Ru_72ae3EtBk6gvAw==
sms-link.8eefede3265fd6c6de07bc0cb5f3f779.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/
1 KB
756 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/sms-link.8eefede3265fd6c6de07bc0cb5f3f779.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9180a94ecd3d5f93f0fb9fcd95a68ec3a9e1decce55694bfb9e5ce6281bdd672
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Thu, 05 Nov 2020 18:39:49 GMT
cf-request-id
08621ff8230000237375af1000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fa446f5-5b2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a03ae02373-ZRH
expires
Sat, 06 Nov 2021 05:47:09 GMT
tnt.nextPrev.f1660ccf5d097410b8b72737d216878c.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/asset/resources/scripts/
4 KB
2 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/asset/resources/scripts/tnt.nextPrev.f1660ccf5d097410b8b72737d216878c.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
714db6fa0eed72832d9a2ac312cf6f78fc51cfdced47f166816b9e6bc90e159a
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Fri, 23 Oct 2020 13:09:57 GMT
cf-request-id
08621ff894000023735a246000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5f92d625-10ff"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a0ec5f2373-ZRH
expires
Wed, 03 Nov 2021 06:15:58 GMT
tnt.ads.init.c2b9574823d0d16ffc6f20eef83f4232.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/ads_blox/resources/scripts/
9 KB
3 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/ads_blox/resources/scripts/tnt.ads.init.c2b9574823d0d16ffc6f20eef83f4232.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd43c41dc23b54388328c3e0833aedddaac3ae7babcc6d94d405d1f9aebb6b8d
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Mon, 16 Nov 2020 16:04:49 GMT
cf-request-id
08621ff803000023735a23c000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fb2a321-251a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a00a6f2373-ZRH
expires
Sat, 20 Nov 2021 08:46:55 GMT
pubads_impl_2021021101.js
securepubads.g.doubleclick.net/gpt/
289 KB
102 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
sffe /
Resource Hash
a533e6ac10f159c258a7737b2a63378e910622fcc61e6c90be14d6d95328fb64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Feb 2021 09:38:54 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
103545
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:00 GMT
tnt.ads.load.6a3c47703ee96f20ef132e36033ca1bc.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/ads_blox/resources/scripts/
886 B
635 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/ads_blox/resources/scripts/tnt.ads.load.6a3c47703ee96f20ef132e36033ca1bc.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
324e02d24f001792f4a75a157af2f5ececa6f0208ce0cbdd8809ad48a3e537c5
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Thu, 05 Nov 2020 18:39:44 GMT
cf-request-id
08621ff92100002373b588b000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fa446f0-376"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a1ce7e2373-ZRH
expires
Sat, 06 Nov 2021 09:29:10 GMT
admanager.js
www.southbendtribune.com/shared-content/art/tncms-ad-manager/
39 KB
13 KB
Script
General
Full URL
https://www.southbendtribune.com/shared-content/art/tncms-ad-manager/admanager.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
7ec48a60849c066e9da617d0db011a6b4d70f743d6295cabdf1c38e5e4de5fe7

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:37:08 GMT
content-encoding
gzip
last-modified
Thu, 05 Nov 2020 15:14:31 GMT
age
171
etag
W/"5fa416d7-9d7c"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=600
x-vcache
HIT
accept-ranges
bytes
content-length
12863
service-worker-allowed
/
/
www.southbendtribune.com/_services/v1/client_ip_info/
79 B
190 B
XHR
General
Full URL
https://www.southbendtribune.com/_services/v1/client_ip_info/
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/shared-content/art/tncms-ad-manager/admanager.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
78ab2b374f16c7b659894ba057e44422eb7b32d6b489e57c38dce0878c59fcd5

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
cache-control
private, max-age=3600
accept-ranges
bytes
content-length
79
content-type
application/json
impressions.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/ads/
84 B
233 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/ads/impressions.js?_dc=1613842533.temp
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9bb8d1b92dbec099db60ce92f7a613d40b8c7cfcca8e4308a904785f8a4d7044
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
cf-ray
624a02a0fc6c2373-ZRH
last-modified
Sat, 20 Feb 2021 17:35:33 GMT
cf-request-id
08621ff89900002373ca18e000000001
x-vcache
HIT
server
cloudflare
etag
W/"60314865-54"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-robots-tag
noarchive
expires
Sun, 20 Feb 2022 17:36:01 GMT
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.24.128 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
8kbPIzTLk7_TMvnggUSDACBTugDfX2qC
content-encoding
gzip
etag
W/"a4d296427fc806b21335359e398c025c"
x-amz-cf-pop
ZAG50-C1
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Fri, 29 Jan 2021 06:42:57 GMT
server
AmazonS3
date
Sat, 20 Feb 2021 17:40:00 GMT
vary
Origin
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 9569de78dc2ca85c5ba29cb17f0eb7ce.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-id
BBYtaPIuHy-ogmIqW3sSsUfD4ruucb84MvLhIL1hCELE0rWi8MWq_w==
traffic.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/ads/
2 KB
929 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/ads/traffic.js?_dc=1613799332
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1cac6c21ae0b04736e4eee03cd0fa9c18fa20f31d6b703531d1c8f5e0f3baebb
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
12585
last-modified
Sat, 20 Feb 2021 05:35:32 GMT
cf-request-id
08621ff91e00002373d42b6000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"60309fa4-600"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a1ce842373-ZRH
expires
Sun, 20 Feb 2022 05:40:45 GMT
settings.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/ads/
3 KB
642 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/ads/settings.js?_dc=1519926682
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9864feca56ca49a1250b88dae34addab3fe6389f51deb995ef7bd89772324d9
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50774
last-modified
Thu, 01 Mar 2018 17:51:22 GMT
cf-request-id
08621ff94100002373ac969000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5a983d9a-cba"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a20f0d2373-ZRH
expires
Fri, 05 Nov 2021 04:55:24 GMT
tnt.facebook.comments.89e3602c68154764e889947868c957c9.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/comments/resources/scripts/
944 B
676 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/comments/resources/scripts/tnt.facebook.comments.89e3602c68154764e889947868c957c9.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
853ea69e5f400c3b2aadf32ec9f1f100a1e95a53e8b828d78035ee39f960389c
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50775
last-modified
Thu, 05 Nov 2020 18:39:39 GMT
cf-request-id
08621ff961000023738abcb000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fa446eb-3b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a23f722373-ZRH
expires
Sun, 07 Nov 2021 06:42:45 GMT
tnt.ads.adverts.66a3812a7b5c12fde8cd998fd691ad7d.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/
198 B
288 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/tnt.ads.adverts.66a3812a7b5c12fde8cd998fd691ad7d.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8416f8febc369c76d3fc82e78d0c49c84bf1dd1904b73cee557fccdbbb5b9005
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50775
last-modified
Fri, 23 Oct 2020 13:09:55 GMT
cf-request-id
08621ff962000023735ca38000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5f92d623-c6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a23f742373-ZRH
expires
Fri, 05 Nov 2021 08:59:52 GMT
fontawesome.edd147e4c2830f416874012247117438.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/
252 KB
88 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/fontawesome.edd147e4c2830f416874012247117438.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ffa8814637fab7a454e06a6403a650615c04044d4f881b04ffdfcdc1395d98da
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50775
last-modified
Mon, 16 Nov 2020 16:05:16 GMT
cf-request-id
08621ff97f000023735a947000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fb2a33c-3f1a7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a26fd12373-ZRH
expires
Sat, 20 Nov 2021 08:46:55 GMT
tracker.js
www.southbendtribune.com/shared-content/art/stats/common/
9 KB
3 KB
Script
General
Full URL
https://www.southbendtribune.com/shared-content/art/stats/common/tracker.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
94afb4609cd5d95128057b67ee0ef36f867bacc074b6e116d874ed8b0852b73f

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:39:16 GMT
content-encoding
gzip
last-modified
Thu, 03 Dec 2020 17:41:07 GMT
age
44
etag
W/"5fc92333-2242"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=600
x-vcache
HIT
accept-ranges
bytes
content-length
3240
service-worker-allowed
/
sbtnavlogo.png
www.southbendtribune.com/app/images/flex/
11 KB
11 KB
Image
General
Full URL
https://www.southbendtribune.com/app/images/flex/sbtnavlogo.png
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
8a1a36d6c054ca80ca5c4af390a0d2dd6eb2baa03db7553e1016d3f6a5af3117

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:35:35 GMT
last-modified
Thu, 28 Apr 2016 14:34:02 GMT
age
265
etag
"57221f5a-2d11"
x-vcache
HIT
content-type
image/png
cache-control
public, max-age=600
accept-ranges
bytes
content-length
11537
navFacebook.png
www.southbendtribune.com/app/images/flex/
603 B
772 B
Image
General
Full URL
https://www.southbendtribune.com/app/images/flex/navFacebook.png?1
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
aae3c2f6e8b0695dc15e3db510f848bb210dff8883c76e9e26fb4a983ddea48c

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:35:17 GMT
last-modified
Thu, 28 Apr 2016 14:38:57 GMT
age
284
etag
"57222081-25b"
x-vcache
HIT
content-type
image/png
cache-control
public, max-age=600
accept-ranges
bytes
content-length
603
navInstagram.png
www.southbendtribune.com/app/images/flex/
4 KB
4 KB
Image
General
Full URL
https://www.southbendtribune.com/app/images/flex/navInstagram.png?1
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
e1566e53067daab167818d04dfa49eec6f3014f47ebdb99665e0adf041c50d38

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:35:17 GMT
last-modified
Thu, 28 Apr 2016 14:44:13 GMT
age
283
etag
"572221bd-eab"
x-vcache
HIT
content-type
image/png
cache-control
public, max-age=600
accept-ranges
bytes
content-length
3755
navTwitter.png
www.southbendtribune.com/app/images/flex/
4 KB
4 KB
Image
General
Full URL
https://www.southbendtribune.com/app/images/flex/navTwitter.png?1
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
8e6e9ff80a703a7ae6c18d6e32cf1a82120b4b924e12eb48a4a2c51c07f55d04

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:37:23 GMT
last-modified
Thu, 28 Apr 2016 14:44:17 GMT
age
158
etag
"572221c1-e8f"
x-vcache
HIT
content-type
image/png
cache-control
public, max-age=600
accept-ranges
bytes
content-length
3727
navEmail.png
www.southbendtribune.com/app/images/flex/
1 KB
1 KB
Image
General
Full URL
https://www.southbendtribune.com/app/images/flex/navEmail.png?2
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
ba1da8deff23f3a0212b9e91ce7f084fde88ffb761338ac767ac3aa11a43b1a1

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:36:13 GMT
last-modified
Thu, 28 Apr 2016 14:44:18 GMT
age
227
etag
"572221c2-48f"
x-vcache
HIT
content-type
image/png
cache-control
public, max-age=600
accept-ranges
bytes
content-length
1167
81c9fb6a-7a3e-11e9-8476-db404cc4a746.jpg
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/custom/image/
6 KB
6 KB
Image
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/custom/image/81c9fb6a-7a3e-11e9-8476-db404cc4a746.jpg?resize=400%2C48
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
503155015069040e25519638bb203658086931fdf677eeedf3b099ed4ed424a3
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
cf-cache-status
HIT
age
50774
last-modified
Sun, 19 May 2019 14:00:49 GMT
strict-transport-security
max-age=604800
content-length
5854
cf-request-id
08621ff98600002373b5895000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
"5551189896a336ccbf3ea2bda21d9baa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Sun, 07 Nov 2021 09:25:20 GMT
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
624a02a26fef2373-ZRH
cf-bgj
h2pri
108d1860-a43e-11e7-8e41-9b2fe7d197cc.jpg
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/custom/image/
13 KB
14 KB
Image
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/custom/image/108d1860-a43e-11e7-8e41-9b2fe7d197cc.jpg
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1beb0c48c582686f60797d006267d72ee06ff4cc72c2216ba1fb37f87e4f78e7
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
cf-cache-status
HIT
age
50774
last-modified
Thu, 28 Sep 2017 11:13:33 GMT
strict-transport-security
max-age=604800
content-length
13798
cf-request-id
08621ff9860000237366aea000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
"59ccd95d-35e6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 05 Nov 2021 05:49:32 GMT
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
624a02a26ff02373-ZRH
cf-bgj
h2pri
css
fonts.googleapis.com/
18 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700,600,200,200italic,400italic,600italic,700italic
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c7b6c1499f2c9d6d0cafcb36fcb48f1ae1ffc94881e0d2ef24204c4bb6e31dd0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 17:40:01 GMT
server
ESF
date
Sat, 20 Feb 2021 17:40:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 20 Feb 2021 17:40:01 GMT
css
fonts.googleapis.com/
4 KB
680 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,900
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
dc6fb48a957f91408d61d92dca66d379f662867ae5361977dd7d11db35081837
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 17:40:01 GMT
server
ESF
date
Sat, 20 Feb 2021 17:40:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 20 Feb 2021 17:40:01 GMT
css
fonts.googleapis.com/
4 KB
636 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Archivo+Narrow:400,700,400italic,700italic
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
87eeba2697ad5eb2b03000df8a4f9bf52e54b665a09afb76d568eed20867da52
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 17:40:01 GMT
server
ESF
date
Sat, 20 Feb 2021 17:40:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 20 Feb 2021 17:40:01 GMT
5d2cc84701b3a.image.jpg
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/assets/v3/editorial/8/57/85723162-bb5f-598e-b9f4-8506f4688e2b/
53 KB
53 KB
Image
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/assets/v3/editorial/8/57/85723162-bb5f-598e-b9f4-8506f4688e2b/5d2cc84701b3a.image.jpg?resize=750%2C464
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
34b44c1dd05445bbbb440006850905d1b77026ae97e380d7c0d902f6d8b42f1e
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
vary
Accept-Encoding
cf-cache-status
MISS
cf-ray
624a02a26ff22373-ZRH
last-modified
Mon, 15 Jul 2019 18:39:03 GMT
cf-request-id
08621ff9880000237382063000000001
x-vcache
MISS
server
cloudflare
etag
"cc77549d533cbfeba9100527ab07a42e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-robots-tag
noarchive
expires
Sun, 20 Feb 2022 17:40:01 GMT
csw-polyfills.js
d2zqfs55y95cft.cloudfront.net/jspoll/5/
Redirect Chain
  • https://www.civicscience.com/jspoll/4/civicscience-widget.js
  • https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-polyfills.js
111 KB
35 KB
Script
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-polyfills.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5cd1c9251fb27cc4b163855c9ce76478a5fa8c2b96e9324ef24fa30e4ec82523

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 15:49:10 GMT
content-encoding
gzip
last-modified
Tue, 16 Feb 2021 21:10:04 GMT
server
AmazonS3
age
6655
etag
W/"3b35c0d750d52436157fe33017fc0f32"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
yD7U9NBgoIiivMh4DAmuXKIe2JzVIpKt6kMIuzgN-NPWhudESFjb2Q==

Redirect headers

location
https://d2zqfs55y95cft.cloudfront.net:443/jspoll/5/csw-polyfills.js
date
Sat, 20 Feb 2021 17:40:01 GMT
server
awselb/2.0
content-length
110
content-type
text/html
e4004754-3328-11e6-9422-83ad34fae49d.jpg
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/custom/image/
114 KB
114 KB
Image
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/custom/image/e4004754-3328-11e6-9422-83ad34fae49d.jpg
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
638564faeb7641243100f0e20ce7bb0f7f969bdf2dc8cc06c5c1c3dfe21bf2ab
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
cf-cache-status
HIT
age
50774
last-modified
Wed, 15 Jun 2016 18:42:20 GMT
strict-transport-security
max-age=604800
content-length
116581
cf-request-id
08621ff98600002373b31d1000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
"5761a18c-1c765"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Sun, 07 Nov 2021 04:55:12 GMT
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
624a02a26ff32373-ZRH
cf-bgj
h2pri
tnt.metering.c1fd4b9015c14b57a58acdbc3ee4daca.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/metering/resources/scripts/
5 KB
2 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/metering/resources/scripts/tnt.metering.c1fd4b9015c14b57a58acdbc3ee4daca.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1b2b0ff251ace3099e3d51a387fe55a16b741832a930a21c0d0b77409e087758
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50775
last-modified
Thu, 05 Nov 2020 18:41:14 GMT
cf-request-id
08621ff9850000237388ba7000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fa4474a-1290"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a26fe02373-ZRH
expires
Sat, 06 Nov 2021 10:11:35 GMT
asset-edit.60e8e67e04be1194326dcfbe7f00b8c3.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/
941 B
498 B
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/asset-edit.60e8e67e04be1194326dcfbe7f00b8c3.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a65fab80371f3ad4c16be0cf8ae8d6542553bb33564b80748ebca97cb615d08
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50775
last-modified
Thu, 05 Nov 2020 18:39:34 GMT
cf-request-id
08621ff98500002373cb8d2000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fa446e6-3ad"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a26fe52373-ZRH
expires
Sat, 06 Nov 2021 06:27:32 GMT
jquery.validate.min.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/
0
0
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/jquery.validate.min.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
sticky-kit.136ae7f2f818eb47f6ccd0348c560674.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/
4 KB
1 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/sticky-kit.136ae7f2f818eb47f6ccd0348c560674.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
572c0831343591911ee6b615e7eee7d8cde9e4443b446ef2e4caf7e0a4b5d753
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50775
last-modified
Mon, 16 Nov 2020 16:05:08 GMT
cf-request-id
08621ff985000023737b30a000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5fb2a334-fec"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a26fe92373-ZRH
expires
Sat, 20 Nov 2021 08:37:01 GMT
tnt.regions.54d9f15b0d238de6bb20ec82ed8307ac.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/
3 KB
1 KB
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.regions.54d9f15b0d238de6bb20ec82ed8307ac.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc168c638e5100e78d92f788ab0e1119353fb2cff24ccbbabd5fced1b9af4b8b
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
50775
last-modified
Fri, 23 Oct 2020 13:08:13 GMT
cf-request-id
08621ff98b0000237390adc000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
W/"5f92d5bd-cd5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
624a02a26fed2373-ZRH
expires
Fri, 05 Nov 2021 06:14:39 GMT
tracker.gif
www.southbendtribune.com/shared-content/art/stats/common/
0
145 B
Image
General
Full URL
https://www.southbendtribune.com/shared-content/art/stats/common/tracker.gif?tnms_rs=1600x1200x24&tnms_upage=1&tnms_do=www.southbendtribune.com&tnms_uri=/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html&tnms_ref=&rt=1613842801121
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
last-modified
Thu, 16 Oct 2008 20:11:25 GMT
age
0
etag
"48f79fed-0"
x-vcache
MISS
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
0
js
www.googletagmanager.com/gtag/
136 KB
52 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-NFTGWT90ER&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5MTD44X&l=dataLayer
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8f4e1ff811b06f7cd65cb73986f3562b03453e62cf2778918c413387d726cc34
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
53467
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:01 GMT
gtm.js
www.googletagmanager.com/
145 KB
44 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PMVGL5
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4de30c6701fd2ac897699f43c249b4098dcb85a06d2eda5451cd204e3033c9c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
45057
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 20 Feb 2021 17:40:01 GMT
survey
survey.g.doubleclick.net/
9 KB
4 KB
Script
General
Full URL
https://survey.g.doubleclick.net/survey?site=_3oyu7ser36htkos5zhx56t754y&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&cid=1613842799&random=1613842801128
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2011 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
cda248969ce5833e845a9668f595488b827e5f3cbde69ac3170fa18a8f1b7fac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, no-cache, must-revalidate, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
vary
*
x-xss-protection
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/g/
0
128 B
Other
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-NFTGWT90ER&gtm=2oe2a1&_p=1106062857&sr=1600x1200&ul=en-us&cid=380505622.1613842800&_s=1&dl=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&dr=&dt=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&sid=1613842801&sct=1&seg=0&en=page_view&_fv=1&_ss=1&ep.application=editorial&ep.theme=flex&ep.asset_id=47a83152-829f-5896-928e-0ba21367ef33&ep.skin_name=flex-editorial&ep.subscription_required=No&epn.blox_render_time=243&up.logged_in=No
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NFTGWT90ER&l=dataLayer&cx=c
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
1 B
26 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1106062857&t=pageview&_s=1&dl=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ul=en-us&de=UTF-8&dt=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAUALAAQCAG~&jid=760820517&gjid=1553823263&cid=380505622.1613842800&tid=UA-18207733-22&_gid=1405610508.1613842800&_r=1&gtm=2wg2a1PMVGL5&z=1799526043
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
1 B
24 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1106062857&t=pageview&_s=1&dl=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ul=en-us&de=UTF-8&dt=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAUALAAQCAG~&jid=454477618&gjid=1011036024&cid=380505622.1613842800&tid=UA-18207733-10&_gid=1405610508.1613842800&_r=1&gtm=2wg2a1PMVGL5&z=1107791220
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
2 B
27 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1106062857&t=pageview&_s=1&dl=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ul=en-us&de=UTF-8&dt=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAUALAAQCAG~&jid=1866179590&gjid=645478781&cid=380505622.1613842800&tid=UA-40741640-1&_gid=1405610508.1613842800&_r=1&gtm=2wg2a1PMVGL5&cd2=anonymous&cd3=news&cd4=business&cd6=desktop&cd8=southbendtribune.com&cd9=flex-editorial&cd10=editorial&cd11=news%2Cbusiness&cd12=22&cd13=Sunny&cd14=local&cd15=article&cd16=By%20Caleb%20Bauer%20South%20Bend%20Tribune%0A&cd7=asset&z=2101301466
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
28 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-40741640-6&cid=380505622.1613842800&jid=347051704&gjid=1688514238&_gid=1405610508.1613842800&_u=aHDAgUALAAQCAG~&z=1291409892
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 20 Feb 2021 17:40:01 GMT
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
iframe_api
www.youtube.com/
810 B
814 B
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
255f18d0a6b07ae588ce53e5ccf75f3db6fff5ab2b418cd110391263376f0b43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
br
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cache-control
private, max-age=0
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000
content-type
text/javascript; charset=utf-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:01 GMT
load.js
s.ntv.io/serve/
348 KB
102 KB
Script
General
Full URL
https://s.ntv.io/serve/load.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMVGL5
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.21.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-59.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
b4ab0c9d469f5fc9747b8f7433e38ebcc71a9bde85103b9ed30606d37bdbc112

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:01 GMT
Content-Encoding
gzip
x-amz-request-id
656FA0C7177A7760
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
x-amz-id-2
+0nPNwjO5Kp81B3CgcCUcpBDMTJJonPJfy5ffXrS00eBzK5YEz06idMVQO/ejMkTCSdxlTpodtk=
Last-Modified
Fri, 05 Feb 2021 18:53:22 GMT
Server
AmazonS3
ETag
"f26986557d331d9bccef002058601094"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
ml.js
js.matheranalytics.com/s/ma90986/605051504/
0
0
Script
General
Full URL
https://js.matheranalytics.com/s/ma90986/605051504/ml.js?cb=1557
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
107.178.250.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
234.250.178.107.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
via
1.1 google
server
nginx
alt-svc
clear
content-type
text/plain
rwhooks.css
hooks.readefined.com/css/
9 KB
10 KB
Stylesheet
General
Full URL
https://hooks.readefined.com/css/rwhooks.css
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMVGL5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.54.243.67 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-243-67.compute-1.amazonaws.com
Software
nginx /
Resource Hash
0f45ec3c67a10161c32f91c74d3fd42bfa409eb45d07ce81de837b45a2f5d622

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
last-modified
Wed, 04 Sep 2019 17:20:06 GMT
server
nginx
etag
"5d6ff246-252e"
content-type
text/css
cache-control
max-age=432000
accept-ranges
bytes
content-length
9518
expires
Thu, 25 Feb 2021 17:40:01 GMT
collect
www.google-analytics.com/
35 B
63 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j88&a=1106062857&t=pageview&_s=1&dl=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ul=en-us&de=UTF-8&dt=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDAgUALAAQCAG~&jid=347051704&gjid=1688514238&cid=380505622.1613842800&tid=UA-40741640-6&_gid=1405610508.1613842800&gtm=2wg2a1PMVGL5&cd2=2021-02-20T18%3A40%3A01.202%2B01%3A00&cd3=GTM-PMVGL5&cd4=45&cd5=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&cd6=&cd8=0&cd9=By%20Caleb%20Bauer%20South%20Bend%20Tribune%0A&cd10=news%2Fbusiness&cd11=article&cd12=07%2F17%2F2019&cd17=southbendtribune.com&cd18=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have&cd20=anonymous&cd23=business&cd7=www.southbendtribune.com&cg1=news%2Fbusiness&cg2=article&cd21=Ad%20Hidden&cd22=news&cd26=&z=286756726
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 03:55:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
49464
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
prompt_embed_static.js
survey.g.doubleclick.net/insights/consumersurveys/static/433191787959557383/
391 KB
391 KB
Script
General
Full URL
https://survey.g.doubleclick.net/insights/consumersurveys/static/433191787959557383/prompt_embed_static.js
Requested by
Host: survey.g.doubleclick.net
URL: https://survey.g.doubleclick.net/survey?site=_3oyu7ser36htkos5zhx56t754y&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&cid=1613842799&random=1613842801128
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2011 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
c5f9661d37f0d356f449c558e3b964ce802d6e90c663e2810393acbf1c055cab

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 19 Feb 2021 21:52:24 GMT
last-modified
Fri, 19 Feb 2021 19:40:27 GMT
server
Google Frontend
age
71257
content-type
application/javascript
x-cloud-trace-context
285151273e6ee813e842ed755f5ddcf8
cache-control
public, max-age=2592000
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
400046
integrator.sync.js
adservice.google.de/adsid/
113 B
176 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.sync.js?domain=www.southbendtribune.com
Requested by
Host: survey.g.doubleclick.net
URL: https://survey.g.doubleclick.net/survey?site=_3oyu7ser36htkos5zhx56t754y&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&cid=1613842799&random=1613842801128
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
108
x-xss-protection
0
collect
stats.g.doubleclick.net/j/
4 B
430 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-40741640-1&cid=380505622.1613842800&jid=1866179590&gjid=645478781&_gid=1405610508.1613842800&_u=aGDAAUALAAQCAG~&z=2130451054
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 20 Feb 2021 17:40:01 GMT
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
www-widgetapi.js
www.youtube.com/s/player/1c732901/www-widgetapi.vflset/
105 KB
38 KB
Script
General
Full URL
https://www.youtube.com/s/player/1c732901/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1826b7680604376f0aac7e5c23e7ba550c3855f9b507a7bfca7391d1d123861f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 19 Feb 2021 13:51:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 18 Feb 2021 01:19:22 GMT
server
sffe
age
100083
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38257
x-xss-protection
0
expires
Sat, 19 Feb 2022 13:51:58 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-40741640-1&cid=380505622.1613842800&jid=1866179590&_u=aGDAAUALAAQCAG~&z=834478034
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-40741640-1&cid=380505622.1613842800&jid=1866179590&_u=aGDAAUALAAQCAG~&z=834478034
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-40741640-6&cid=380505622.1613842800&jid=347051704&_u=aHDAgUALAAQCAG~&z=992457766
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-40741640-6&cid=380505622.1613842800&jid=347051704&_u=aHDAgUALAAQCAG~&z=992457766
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
jquery.validate.min.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/
0
0
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/jquery.validate.min.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
prompt
survey.g.doubleclick.net/gk/
0
281 B
Script
General
Full URL
https://survey.g.doubleclick.net/gk/prompt?site=_3oyu7ser36htkos5zhx56t754y&t=1&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&cid=1613842799&random=1613842801214&ref=&token=NT
Requested by
Host: survey.g.doubleclick.net
URL: https://survey.g.doubleclick.net/survey?site=_3oyu7ser36htkos5zhx56t754y&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&cid=1613842799&random=1613842801128
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2011 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-why
UserPrivacyInfo does not meet requirements to be served (LAT and/or OPT_OUT modifier).
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 20 Feb 2021 17:40:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23
x-xss-protection
0
truncated
/
73 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bc40838a707dba656095bdce002939c726b0fe7de618b613ff3a29a39aef0938

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v14/
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700,600,200,200italic,400italic,600italic,700italic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700,600,200,200italic,400italic,600italic,700italic
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 19 Feb 2021 14:22:45 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:11 GMT
server
sffe
age
98236
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12976
x-xss-protection
0
expires
Sat, 19 Feb 2022 14:22:45 GMT
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v14/
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700,600,200,200italic,400italic,600italic,700italic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700,600,200,200italic,400italic,600italic,700italic
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 19:41:26 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:14 GMT
server
sffe
age
165515
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13324
x-xss-protection
0
expires
Fri, 18 Feb 2022 19:41:26 GMT
6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDJB9cme.woff2
fonts.gstatic.com/s/sourcesanspro/v14/
12 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v14/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDJB9cme.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700,600,200,200italic,400italic,600italic,700italic
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7cc2c8a7bd96173ee2a862c122630ab8d45ad0676ad2ad60fc55307763782230
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700,600,200,200italic,400italic,600italic,700italic
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 09:18:03 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:03 GMT
server
sffe
age
202918
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12656
x-xss-protection
0
expires
Fri, 18 Feb 2022 09:18:03 GMT
6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18S0xR41.woff2
fonts.gstatic.com/s/sourcesanspro/v14/
12 KB
12 KB
Font
General
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18S0xR41.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700,600,200,200italic,400italic,600italic,700italic
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b90bddaa859eeeff46ee20815774c407611aeb85de431d919cb8e50f18a4d693
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700,600,200,200italic,400italic,600italic,700italic
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 19:41:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:17 GMT
server
sffe
age
165514
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12628
x-xss-protection
0
expires
Fri, 18 Feb 2022 19:41:27 GMT
pagefold-bg.png
www.southbendtribune.com/app/images/flex/
156 B
324 B
Image
General
Full URL
https://www.southbendtribune.com/app/images/flex/pagefold-bg.png
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/content/tncms/live/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
9205bbda33f2a8b396c31ca48b22eb8420772716f50eb8339c00e8bb5c7e1826

Request headers

Referer
https://www.southbendtribune.com/content/tncms/live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:35:18 GMT
last-modified
Wed, 25 May 2016 16:04:34 GMT
age
282
etag
"5745cd12-9c"
x-vcache
HIT
content-type
image/png
cache-control
public, max-age=600
accept-ranges
bytes
content-length
156
pagefold-end-v3.png
www.southbendtribune.com/app/images/flex/
426 B
595 B
Image
General
Full URL
https://www.southbendtribune.com/app/images/flex/pagefold-end-v3.png
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/content/tncms/live/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
84d6b5189fa1b48da019723ff855f03e04cff06518179e3b0cdd5939786a67b4

Request headers

Referer
https://www.southbendtribune.com/content/tncms/live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:38:02 GMT
last-modified
Wed, 25 May 2016 16:43:19 GMT
age
119
etag
"5745d627-1aa"
x-vcache
HIT
content-type
image/png
cache-control
public, max-age=600
accept-ranges
bytes
content-length
426
pagefold-txtbg.png
www.southbendtribune.com/app/images/flex/
150 B
318 B
Image
General
Full URL
https://www.southbendtribune.com/app/images/flex/pagefold-txtbg.png
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/content/tncms/live/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
0207e3b213cecb8b4704fdfb5660443f6c2e89b7150ddf3bd2f286dfe24a283f

Request headers

Referer
https://www.southbendtribune.com/content/tncms/live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:38:02 GMT
last-modified
Wed, 25 May 2016 16:04:35 GMT
age
119
etag
"5745cd13-96"
x-vcache
HIT
content-type
image/png
cache-control
public, max-age=600
accept-ranges
bytes
content-length
150
jquery.validate.min.js
bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/
0
0
Script
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/jquery.validate.min.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
t
jadserve.postrelease.com/
1 KB
1 KB
Script
General
Full URL
https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ntv_mvi
Requested by
Host: s.ntv.io
URL: https://s.ntv.io/serve/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.46.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-8-46-140.us-west-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
67c4b15e2700db5a2b5b863230fefa9e7a821f5b0cccf8c877896d512c0d5a83

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
gzip
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
text/javascript;charset=UTF-8
content-length
701
expires
Mon, 1 Jan 1990 12:00:00 GMT
5d3362d4a6514.image.jpg
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/assets/v3/editorial/6/2b/62b5a97d-4bfd-52af-86b0-d17765638a42/
9 KB
9 KB
Image
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/assets/v3/editorial/6/2b/62b5a97d-4bfd-52af-86b0-d17765638a42/5d3362d4a6514.image.jpg?resize=300%2C209
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32f7a508897772600d78e7981a7509262a77379dc65969eb5099bbd211cf96cc
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
vary
Accept-Encoding
cf-cache-status
MISS
last-modified
Sat, 20 Jul 2019 18:52:04 GMT
content-length
8756
cf-request-id
08621ffb5e00002373a1014000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
"7d2eb124d0c8b18f8422e98255d736ff"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
624a02a56f572373-ZRH
expires
Sun, 20 Feb 2022 17:40:01 GMT
collect
www.google-analytics.com/j/
2 B
25 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j88&aip=1&a=1106062857&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ul=en-us&de=UTF-8&dt=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=subscription&ea=free%20view&el=first%20view&ev=1&_u=aHDAAUALAAQCAG~&jid=878109170&gjid=1489678943&cid=380505622.1613842800&tid=UA-54716522-7&_gid=1405610508.1613842800&_r=1&gtm=2wg2a1PDQV3N&cd2=editorial&cd3=flex&cd4=flex-editorial&cd5=no&cd6=Large%3A%20Desktop%20computers.&cd8=200&cd9=No&cd10=No&cd12=No&cd13=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-122-million-it-didnt-have%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&cd16=No&cd17=Page%20View&cd20=47a83152-829f-5896-928e-0ba21367ef33&cm1=243&cm2=1&z=1573924329
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.southbendtribune.com/tncms/search/mlt/
18 KB
6 KB
XHR
General
Full URL
https://www.southbendtribune.com/tncms/search/mlt/?origin=47a83152-829f-5896-928e-0ba21367ef33&app=editorial&preview=1&type=article%2Ccollection%2Cvideo%2Cyoutube
Requested by
Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/asset/resources/scripts/tnt.nextPrev.f1660ccf5d097410b8b72737d216878c.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS
cms.newyork1.vip.townnews.com
Software
/
Resource Hash
278eb320f671875791c76b0183901d055d6806277bc0c15369d6d97ae99b17b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
last-modified
Mon, 12 Aug 2019 22:11:07 GMT
content-length
5693
x-xss-protection
1; mode=block
x-loop
1
referrer-policy
strict-origin-when-cross-origin
x-vcache
MISS
x-frame-options
SAMEORIGIN
etag
W/d7a531307f44ec2f1d6204bdbd6e1776
vary
X-IPCountry, Accept-Encoding
content-type
application/json; charset=UTF-8
x-tncms
1.56.3; app3; 4.24s; 3.2M
cache-control
public, max-age=300
accept-ranges
bytes
x-robots-tag
noarchive
collect
www.google-analytics.com/j/
2 B
25 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1106062857&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ul=en-us&de=UTF-8&dt=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Ad%20Block&ea=Ads%20Loaded&el=%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&_u=aHDAAUALAAQCAG~&jid=900036588&gjid=2113022686&cid=380505622.1613842800&tid=UA-40741640-6&_gid=1405610508.1613842800&_r=1&gtm=2wg2a1PMVGL5&cd17=Ads%20Loaded&z=469097723
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
loader.js
cdn.taboola.com/libtrc/schurz-network/
286 KB
31 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/schurz-network/loader.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
daf153362023b9fe43ea16f591fcb28b5688dc589a3b85c03cba44ede35aa479

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
RiGQ3_SVsF5lSTjZItRcUhaPqWmK4GZ.
content-encoding
gzip
etag
"8aaf246ba57ebd2a6469af199f4eb0b6"
age
0
x-cache
HIT
content-length
31373
x-amz-id-2
HVr4psXVQrPJaWDHRf2xladnUMS/IsVv7UmHaiUh4EpKdugCgxVWJK4GuEwkoe02WAfboFaNrTw=
x-served-by
cache-hhn11566-HHN
last-modified
Thu, 18 Feb 2021 13:22:34 GMT
server
AmazonS3
x-timer
S1613842802.626823,VS0,VE103
date
Sat, 20 Feb 2021 17:40:01 GMT
vary
Accept-Encoding
x-amz-request-id
478C46930F35A649
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
67
x-cache-hits
1
collect
stats.g.doubleclick.net/j/
1 B
27 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-54716522-7&cid=380505622.1613842800&jid=878109170&gjid=1489678943&_gid=1405610508.1613842800&_u=aHDAAUALAAQCAG~&z=1684513553
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 20 Feb 2021 17:40:01 GMT
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
embed.js
cdn4.wibbitz.com/south_bend_tribune/
0
0
Script
General
Full URL
https://cdn4.wibbitz.com/south_bend_tribune/embed.js
Requested by
Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.6edb5af3e93b0a377ec925c5f1c6ddde.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.24.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-24-29.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

collect
stats.g.doubleclick.net/j/
4 B
28 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-40741640-6&cid=380505622.1613842800&jid=900036588&gjid=2113022686&_gid=1405610508.1613842800&_u=aHDAAUALAAQCAG~&z=245595278
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 20 Feb 2021 17:40:01 GMT
content-type
text/plain
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
jot
www.civicscience.com/
0
0
Fetch
General
Full URL
https://www.civicscience.com/jot?j=1106764261.4090028691&n=0&s=poll&t=created&d=%7B%22target%22%3A%22e61b274f-6201-c424-19d4-b55017cfd362%22%2C%22instance%22%3A%22civsci-id-644047001%22%2C%22isContainerSeen%22%3Atrue%2C%22context%22%3A%22%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%2C%22wx%22%3A0%2C%22wy%22%3A0%2C%22wh%22%3A1200%2C%22ww%22%3A1600%2C%22cx%22%3A15%2C%22cy%22%3A818%7D
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.81.50.0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache/2.4.39 (Amazon) /
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
last-modified
Fri, 30 Aug 2019 14:44:32 GMT
server
Apache/2.4.39 (Amazon)
accept-ranges
bytes
etag
"0-59156a8fe3400"
content-length
0
content-type
text/plain; charset=UTF-8
bootstrap
www.civicscience.com/widget/api/2/
297 B
400 B
Script
General
Full URL
https://www.civicscience.com/widget/api/2/bootstrap?target=e61b274f-6201-c424-19d4-b55017cfd362&instance=civsci-id-644047001&context=%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&mv=5&_=1613842801568&callback=jsonp_1613842801568_64575
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.81.50.0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.2.34 / PHP/7.2.34
Resource Hash
26efda059c12e94e3905f155438a6a8812d734bcafd8e2b7bd17a412b002caa1

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
gzip
server
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.2.34
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
ga-audiences
www.google.com/ads/
42 B
483 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-40741640-6&cid=380505622.1613842800&jid=900036588&_u=aHDAAUALAAQCAG~&z=608253614
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
483 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-40741640-6&cid=380505622.1613842800&jid=900036588&_u=aHDAAUALAAQCAG~&z=608253614
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
target
www.civicscience.com/widget/api/2/
1 KB
894 B
Script
General
Full URL
https://www.civicscience.com/widget/api/2/target?target=e61b274f-6201-c424-19d4-b55017cfd362&instance=civsci-id-644047001&context=%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&mv=5&_=1613842801711&callback=jsonp_1613842801712_41440
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.81.50.0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.2.34 / PHP/7.2.34
Resource Hash
e9fe32bcbb33e6cf2310d1764a3b0be1ef585df28f5816ad12f30b84f4951840

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
gzip
server
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.2.34
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
impl.20210217-27-RELEASE.js
cdn.taboola.com/libtrc/
464 KB
107 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/impl.20210217-27-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/schurz-network/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3-br /
Resource Hash
5b915e51afd63806bc0d4dd60b6c67e6afb6e0186805db493bb359bc8ee079d9

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
fCEDBKh25xauefxJ50buCfL3SnIyLwqe
content-encoding
br
etag
"c1d85a84c29b4ce1e889d267b9f3a8be"
age
16437
x-cache
HIT
content-length
109508
x-amz-id-2
Uh+fidS04kkeMl4f88d3NvoZ+eyAYTY5FqUSX9/FU+9pFBStVxVu2B/RXBxs+EURlqYVyvg42/E=
x-served-by
cache-hhn11566-HHN
last-modified
Thu, 18 Feb 2021 13:05:51 GMT
server
AmazonS3-br
x-timer
S1613842802.802932,VS0,VE0
date
Sat, 20 Feb 2021 17:40:01 GMT
vary
Accept-Encoding
x-amz-request-id
EA98BA4FDC4ADBED
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript
abp
80
x-cache-hits
98297
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/schurz-network/loader.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.25.115.49 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-25-115-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:01 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
884
Expires
Sun, 21 Feb 2021 17:40:01 GMT
json
trc.taboola.com/schurz-southbendtribune/trc/3/
31 B
311 B
XHR
General
Full URL
https://trc.taboola.com/schurz-southbendtribune/trc/3/json?tim=18%3A40%3A01.895&lti=deflated&data=%7B%22id%22%3A62%2C%22ii%22%3A%22%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-122-million-it-didnt-have%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1613654551326%2C%22vi%22%3A1613842801885%2C%22cv%22%3A%2220210217-27-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-122-million-it-didnt-have%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A3248%2C%22nsid%22%3A%22schurz-network%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A6%2C%22uim%22%3A%22thumbnails-c%3Apub%3Dschurz-network%3Aabp%3D0%22%2C%22uip%22%3A%22Integrated%20Video%20Thumbnails%22%2C%22orig_uip%22%3A%22Integrated%20Video%20Thumbnails%22%2C%22cd%22%3A2766%2C%22mw%22%3A750%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210217-27-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ef3b2092c6bd1a3a6855b7a3a0d67951f0b7cd1678bbcfe563226bfe8a2b9126

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

x-vcl-time-ms
57
date
Sat, 20 Feb 2021 17:40:01 GMT
content-encoding
gzip
server
nginx
x-timer
S1613842802.923683,VS0,VE57
x-served-by
cache-hhn11566-HHN
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-credentials
true
accept-ranges
bytes
content-type
text/plain;charset=utf-8
via
1.1 varnish
x-cache-hits
0
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1613842801907&ns_c=UTF-8&cv=3.5&c8=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%2...
  • https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1613842801907&ns_c=UTF-8&cv=3.5&c8=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%...
0
528 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1613842801907&ns_c=UTF-8&cv=3.5&c8=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&c7=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&c9=&cs_ak_ss=1
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.25.115.49 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-25-115-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:01 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1613842801907&ns_c=UTF-8&cv=3.5&c8=Elkhart%20payroll%20company%20accused%20of%20fraudulently%20wiring%20%24122%20million%20it%20didn%27t%20have%20%7C%20Business%20%7C%20southbendtribune.com&c7=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&c9=&cs_ak_ss=1
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:01 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
csw-ae.5.3.2.css
d2zqfs55y95cft.cloudfront.net/jspoll/5/
6 KB
2 KB
Stylesheet
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-ae.5.3.2.css
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e649cc348287d336e60aad999614efb990f435d63577fecb81ad229c01a78497

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 19 Feb 2021 21:10:48 GMT
content-encoding
gzip
last-modified
Tue, 16 Feb 2021 21:10:04 GMT
server
AmazonS3
age
143336
etag
W/"9806f2fb75f0fec0d6f7e6b8bbeacbcc"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
AB7Hiof3KZRBCTXF0_oRJbsiIy_CkYm32DO0oJw6caz8ryxaf9NqlA==
csw-ae.5.3.2.js
d2zqfs55y95cft.cloudfront.net/jspoll/5/
12 KB
4 KB
Script
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-ae.5.3.2.js
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
88f2461b0f7239c483efd36b6921359dbcb0517bc5247b71fd2d1e613e4e7dc9

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 19 Feb 2021 21:10:48 GMT
content-encoding
gzip
last-modified
Tue, 16 Feb 2021 21:10:05 GMT
server
AmazonS3
age
73776
etag
W/"14d3b32c442e9349254bd5e5b8cd46a7"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
fjgcEanMnc1J7LYaqZxhjPVWBMbQaFZDgAO4c5Ak7Qk5zHmB8T_JXw==
enUS.json
d2zqfs55y95cft.cloudfront.net/jspoll/5/locales/
4 KB
4 KB
Fetch
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/locales/enUS.json?pv=5.3.2
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2966d2244bc6b8f2421d91abf5f6015b15273302999fb79d911306a0ee89e3e4

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 05:18:37 GMT
via
1.1 4162b603e4967e54c2386fa354705d6e.cloudfront.net (CloudFront)
last-modified
Tue, 16 Feb 2021 21:10:05 GMT
server
AmazonS3
age
44485
etag
"16e1ab7738e9af5926f1c5ef978df1c2"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
*
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA56-C1
content-length
3958
x-amz-cf-id
WEWLwD-pFZhFEbKyTvoIdOM-ty90U1kCBQGyobd0C97_35TIBBz-pg==
debug
trc-events.taboola.com/schurz-southbendtribune/log/2/
0
278 B
Image
General
Full URL
https://trc-events.taboola.com/schurz-southbendtribune/log/2/debug?tim=18%3A40%3A01.992&type=error&msg=Server%20did%20not%20respond%20to%20loadRBox&id=484&cv=20210217-27-RELEASE&lt=deflated&pct=1
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:02 GMT
server
nginx
x-fastly-to-nlb-rtt
12932
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
tbl-x-upstream
10.41.22.181:10213
debug
trc-events.taboola.com/schurz-southbendtribune/log/2/
0
277 B
Image
General
Full URL
https://trc-events.taboola.com/schurz-southbendtribune/log/2/debug?tim=18%3A40%3A01.993&type=error&msg=loadRBox%20failed%2C%20aborting.&id=5058&cv=20210217-27-RELEASE&lt=deflated&pct=1
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:02 GMT
server
nginx
x-fastly-to-nlb-rtt
12932
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
tbl-x-upstream
10.41.34.201:10213
debug
trc-events.taboola.com/schurz-southbendtribune/log/2/
0
276 B
Image
General
Full URL
https://trc-events.taboola.com/schurz-southbendtribune/log/2/debug?tim=18%3A40%3A01.994&type=warn&msg=Invalid%20response%20from%20server%3A%20trc_json_response%20%3D%0A%7B%22trc%22%3A%7B%7D%7D%0A&id=7969&cv=20210217-27-RELEASE&lt=deflated&pct=1
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:02 GMT
server
nginx
x-fastly-to-nlb-rtt
12932
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
tbl-x-upstream
10.40.0.199:10213
Cookie set zone
bluellipse.advertserve.com/servlet/view/banner/url/ Frame 5818
6 KB
7 KB
Document
General
Full URL
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
0bf918e95765cdd24965e6bed8f1a9ad00972f687334b56455fae1f5c90935a6

Request headers

Host
bluellipse.advertserve.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.southbendtribune.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

Server
nginx
Date
Sat, 20 Feb 2021 17:40:02 GMT
Content-Type
text/html;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
no-cache, no-store
Pragma
no-cache
Expires
Thu, 31 Dec 1998 11:59:59 GMT
X-Robots-Tag
none
P3P
CP="NOI DSP COR NID"
Set-Cookie
AVPUID=a6405b0240a31794c6cdecee278d8609; Expires=Sun, 20-Feb-2022 17:40:02 GMT; Path=/; Secure; HttpOnly; SameSite=None JSESSIONID=C7423DE418A1E5988EB48CB1E749730A; Path=/; Secure; HttpOnly
csw-frame.5.3.2.js
d2zqfs55y95cft.cloudfront.net/jspoll/5/
6 KB
3 KB
Script
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-frame.5.3.2.js
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2fdbf10bb59053ad07aff10c7f1dac0a30848a3dca681b25e88b310ea5f96a56

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 02:27:31 GMT
content-encoding
gzip
last-modified
Tue, 16 Feb 2021 21:10:04 GMT
server
AmazonS3
age
82451
etag
W/"73484ce44dbfd117e24b03a4d0ff4001"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
bUH_K9hLJh9-u8Yai3blW0YC9s2At1lWdMmwsKUA2Uq7-BI5Zg1Vug==
session
www.civicscience.com/widget/api/2/
1 KB
903 B
Script
General
Full URL
https://www.civicscience.com/widget/api/2/session?target=1567&instance=civsci-id-644047001&context=%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&mv=5&_=1613842802013&callback=jsonp_1613842802013_54194
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.81.50.0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.2.34 / PHP/7.2.34
Resource Hash
845b498b0ccf66d0108b13e2eb10258dea7f8dbd5ddda4c0b6f14f57d03187f9

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:03 GMT
content-encoding
gzip
server
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.2.34
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
trk.gif
jadserve.postrelease.com/
43 B
622 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=a1624684-4f51-42ee-94de-6330f2cade9d&ntv_fl=5j6K0SrXS9BkMDZOoNh3cgO7VRj-f7lG6a2LnbwL8kl9_onFYHBgq5Pp1Hps5wJ8KZ_ODWonY-IcGbQVD2AihwFKxQbJ4aIiLtoM2XjxFvw=&ntv_ht=cUkxYAA&ntv_at=303,302&ntv_a=AAAAAAAAAAwH0FA&ord=1613842802091&ntv_dpl=1011,1028,1050,1003,1019,1006,1007&ntv_it
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.46.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-8-46-140.us-west-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:02 GMT
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
csw.5.3.2.css
d2zqfs55y95cft.cloudfront.net/jspoll/5/ Frame 175B
74 KB
12 KB
Stylesheet
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw.5.3.2.css?pv=5.3.2
Requested by
Host: d2zqfs55y95cft.cloudfront.net
URL: https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-frame.5.3.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
952f616c1e03c8671b9640dc4ca7f7f79b4d7e7d279b02b3aae7eb604b20bce5

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 01:54:35 GMT
content-encoding
gzip
last-modified
Tue, 16 Feb 2021 21:10:05 GMT
server
AmazonS3
age
75346
etag
W/"5c863217120dabeb7c790b089a64aa31"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
4r4UDcKvyL2ClUuVmzTEL43OO8-OsQGWxf4WnNWNTJh1QyZAWB5hvQ==
csw-widget.5.3.2.js
d2zqfs55y95cft.cloudfront.net/jspoll/5/
70 KB
16 KB
Script
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-widget.5.3.2.js
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cbc99185b3da4183480aa2f2493f0e2d069fb3eeb4bff772fcd7f20ebb37378

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 05:16:38 GMT
content-encoding
gzip
last-modified
Tue, 16 Feb 2021 21:10:05 GMT
server
AmazonS3
age
44869
etag
W/"074ea32112f4f1a1c0d2a2c7d0408624"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
yNmvovh8Ru0KmUjZlCnAQ9ZbP-WuRaYWkm5LxfOMS_mfrGjKZ43WdA==
cs-logo.svg
d2zqfs55y95cft.cloudfront.net/jspoll/5/images/ Frame 175B
2 KB
1 KB
Image
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/images/cs-logo.svg
Requested by
Host: d2zqfs55y95cft.cloudfront.net
URL: https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw.5.3.2.css?pv=5.3.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d22ff2db56f5753470cd48729c733aa38ef15705c62f028812cdd3c51e640a4

Request headers

Referer
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw.5.3.2.css?pv=5.3.2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 19 Feb 2021 21:11:03 GMT
content-encoding
gzip
last-modified
Tue, 16 Feb 2021 21:10:05 GMT
server
AmazonS3
age
154767
etag
W/"6b65cdc801f5a66588042f09b2e1049e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
ddLky7EcY5bTaFZ5lPd5JJAv9EwsBQWK3E_cdewiTKvhb5f4_h9Bhw==
csw-icon.ttf
d2zqfs55y95cft.cloudfront.net/jspoll/5/fonts/ Frame 175B
4 KB
4 KB
Font
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/fonts/csw-icon.ttf
Requested by
Host: d2zqfs55y95cft.cloudfront.net
URL: https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw.5.3.2.css?pv=5.3.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
72df55b97acfdeeea6e5c0fc4781d5b8be62bba01db82b6ee5cbd201828b4e63

Request headers

Origin
https://www.southbendtribune.com
Referer
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw.5.3.2.css?pv=5.3.2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:38:48 GMT
via
1.1 4162b603e4967e54c2386fa354705d6e.cloudfront.net (CloudFront)
last-modified
Tue, 16 Feb 2021 21:10:05 GMT
server
AmazonS3
age
75
etag
"08bc34b0eb9839f80dfd02fd3c5b120f"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA56-C1
content-length
4004
x-amz-cf-id
HNJrfFZA14LN9u6oT346N6dbSjBq6rlIjjvnLafIL2gpRw_HkMzAug==
vendors~csw-vendor-dompurify.5.3.2.js
d2zqfs55y95cft.cloudfront.net/jspoll/5/
17 KB
7 KB
Script
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/vendors~csw-vendor-dompurify.5.3.2.js
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
38ad6752ce36169b2e8631b8b985e80282f9104ac1953fb06bfd67f79757cf93

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 19 Feb 2021 21:10:35 GMT
content-encoding
gzip
last-modified
Tue, 16 Feb 2021 21:10:05 GMT
server
AmazonS3
age
73774
etag
W/"68dbefbddfd2408b1f24a58bd80796eb"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
CkAJ7g7t6UOg_3tDbAozT83XLa1bgIT2sHhSndnWSEEBRTMECOMQxA==
csw-vendor-webfontloader.5.3.2.js
d2zqfs55y95cft.cloudfront.net/jspoll/5/
12 KB
5 KB
Script
General
Full URL
https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-vendor-webfontloader.5.3.2.js
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4c00:f:c7b3:ce40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
579527bf4fbad50c8c68cd1c6ba80617166db5308609ace41719395a6d6fa1e5

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 19 Feb 2021 21:11:03 GMT
content-encoding
gzip
last-modified
Tue, 16 Feb 2021 21:10:05 GMT
server
AmazonS3
age
73768
etag
W/"bca49c03fa78bbcd9ac8dfec22481b53"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
j_l69xe06THbfwMfCc4UB7eTgwrotmgOYl9gBoloL9vIVijdWln45A==
css
fonts.googleapis.com/ Frame 175B
4 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700
Requested by
Host: d2zqfs55y95cft.cloudfront.net
URL: https://d2zqfs55y95cft.cloudfront.net/jspoll/5/csw-vendor-webfontloader.5.3.2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
9e44c7950e21714a4b15ef8ba7c600452f1ec8ace7f1a9a0f3d517aa134f6e64
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 16:38:07 GMT
server
ESF
date
Sat, 20 Feb 2021 17:40:02 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 20 Feb 2021 17:40:02 GMT
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 175B
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 19:41:26 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:14 GMT
server
sffe
age
165516
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13324
x-xss-protection
0
expires
Fri, 18 Feb 2022 19:41:26 GMT
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 175B
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 19 Feb 2021 14:22:45 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:11 GMT
server
sffe
age
98237
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12976
x-xss-protection
0
expires
Sat, 19 Feb 2022 14:22:45 GMT
browser.js
bluellipse.advertserve.com/js/ Frame 5818
5 KB
2 KB
Script
General
Full URL
https://bluellipse.advertserve.com/js/browser.js?v=1610679797801
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
1ef740db793a937f6f4368858e143840f00d623232908a29950b19250ddc25c6

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:02 GMT
Content-Encoding
gzip
Last-Modified
Thu, 14 Jan 2021 17:05:10 GMT
Server
nginx
Vary
Accept-Encoding, Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
public, max-age=86400
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Sun, 21 Feb 2021 17:40:02 GMT
png.js
bluellipse.advertserve.com/js/ Frame 5818
816 B
869 B
Script
General
Full URL
https://bluellipse.advertserve.com/js/png.js?v=1610679797801
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
b8b5d010122cf6813861787f82cd5d3cfa18406f94d05f86328011aa8a702f59

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 14 Jan 2021 17:05:10 GMT
Server
nginx
Vary
Accept-Encoding, Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
public, max-age=86400
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Sun, 21 Feb 2021 17:40:02 GMT
gui.js
bluellipse.advertserve.com/js/ Frame 5818
6 KB
2 KB
Script
General
Full URL
https://bluellipse.advertserve.com/js/gui.js?v=1610679797801
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
ba8907ca7a1f277e5e95eb15afdd77b474d669fd00105d9643068640ba629269

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 14 Jan 2021 17:05:10 GMT
Server
nginx
Vary
Accept-Encoding, Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
public, max-age=86400
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Sun, 21 Feb 2021 17:40:02 GMT
base.css
bluellipse.advertserve.com/css/ Frame 5818
16 KB
2 KB
Stylesheet
General
Full URL
https://bluellipse.advertserve.com/css/base.css?v=1610679797801
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
39d53a5ff9d96f40e74b5613e1bf6f6b4ccea46da948d4450d5eb95e612424ae

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 14 Jan 2021 17:05:08 GMT
Server
nginx
Vary
Accept-Encoding, Accept-Encoding
Content-Type
text/css;charset=UTF-8
Cache-Control
public, max-age=86400
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Sun, 21 Feb 2021 17:40:02 GMT
tile.css
bluellipse.advertserve.com/css/ Frame 5818
7 KB
1 KB
Stylesheet
General
Full URL
https://bluellipse.advertserve.com/css/tile.css?v=1610679797801
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
b7fbd0c1297c9d16c59a0400b9412bc4569008e75df4025d673be007f5205f61

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 14 Jan 2021 17:05:08 GMT
Server
nginx
Vary
Accept-Encoding, Accept-Encoding
Content-Type
text/css;charset=UTF-8
Cache-Control
public, max-age=86400
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Sun, 21 Feb 2021 17:40:02 GMT
topleft.gif
bluellipse.advertserve.com/images/control/tile/ Frame 5818
53 B
367 B
Image
General
Full URL
https://bluellipse.advertserve.com/images/control/tile/topleft.gif
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
b8798d9fb74423ed28687c00f93253c94650461ff8bd5b2fc894ee832548017f

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Last-Modified
Thu, 15 Nov 2018 16:16:02 GMT
Server
nginx
ETag
W/"53-1542298562000"
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
53
Expires
Sun, 21 Feb 2021 17:40:03 GMT
topmiddle.gif
bluellipse.advertserve.com/images/control/tile/ Frame 5818
807 B
1 KB
Image
General
Full URL
https://bluellipse.advertserve.com/images/control/tile/topmiddle.gif
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
e95b089c0e2dd9e9d55f282cf56414d1cb1be179a6265291808c0bb97ceec089

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Last-Modified
Thu, 15 Nov 2018 16:16:02 GMT
Server
nginx
ETag
W/"807-1542298562000"
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
807
Expires
Sun, 21 Feb 2021 17:40:03 GMT
topright.gif
bluellipse.advertserve.com/images/control/tile/ Frame 5818
53 B
367 B
Image
General
Full URL
https://bluellipse.advertserve.com/images/control/tile/topright.gif
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
39d082a23f97acb018f116df42b520931c365c526354e5ddaf6f571ceb0d6541

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Last-Modified
Thu, 15 Nov 2018 16:16:02 GMT
Server
nginx
ETag
W/"53-1542298562000"
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
53
Expires
Sun, 21 Feb 2021 17:40:03 GMT
invisible.gif
bluellipse.advertserve.com/images/ Frame 5818
49 B
363 B
Image
General
Full URL
https://bluellipse.advertserve.com/images/invisible.gif
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
06fb0b3354a4f71ddcd06b075b64d0e51f38496ca5e37e303ab7ba0c44b3f984

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Last-Modified
Thu, 15 Nov 2018 16:16:02 GMT
Server
nginx
ETag
W/"49-1542298562000"
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
49
Expires
Sun, 21 Feb 2021 17:40:03 GMT
error.png
bluellipse.advertserve.com/images/control/icons/48x48/shadow/ Frame 5818
3 KB
4 KB
Image
General
Full URL
https://bluellipse.advertserve.com/images/control/icons/48x48/shadow/error.png
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
c9e1914b93c97bfb84326dabb74ab7a17c63706f8a62637fe281eedae6b50653

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Last-Modified
Thu, 15 Nov 2018 16:16:02 GMT
Server
nginx
ETag
W/"3360-1542298562000"
Content-Type
image/png
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3360
Expires
Sun, 21 Feb 2021 17:40:03 GMT
bottomleft.gif
bluellipse.advertserve.com/images/control/tile/ Frame 5818
53 B
367 B
Image
General
Full URL
https://bluellipse.advertserve.com/images/control/tile/bottomleft.gif
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
b8ce447517dc452915a85b732b245f19bad8e41edb6bb227732ba3ed488a8e7b

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Last-Modified
Thu, 15 Nov 2018 16:16:02 GMT
Server
nginx
ETag
W/"53-1542298562000"
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
53
Expires
Sun, 21 Feb 2021 17:40:03 GMT
bottommiddle.gif
bluellipse.advertserve.com/images/control/tile/ Frame 5818
807 B
1 KB
Image
General
Full URL
https://bluellipse.advertserve.com/images/control/tile/bottommiddle.gif
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
b8f66dd521fbaaf876e78b37cf6fb0b1805df060ecaef84560ec366dba1c0508

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Last-Modified
Thu, 15 Nov 2018 16:16:02 GMT
Server
nginx
ETag
W/"807-1542298562000"
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
807
Expires
Sun, 21 Feb 2021 17:40:03 GMT
bottomright.gif
bluellipse.advertserve.com/images/control/tile/ Frame 5818
53 B
367 B
Image
General
Full URL
https://bluellipse.advertserve.com/images/control/tile/bottomright.gif
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
47c408e0c286e6ebbdae1ed851d3e73cf15b498e99e636b97007254f6f0f660f

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Last-Modified
Thu, 15 Nov 2018 16:16:02 GMT
Server
nginx
ETag
W/"53-1542298562000"
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
53
Expires
Sun, 21 Feb 2021 17:40:03 GMT
trk.gif
jadserve.postrelease.com/
43 B
339 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_at=386,387,388,389&ntv_r1=1901&ntv_r2=1901&ntv_r3=1901&ntv_r4=1901&ntv_pl=359872&ntv_it
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.46.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-8-46-140.us-west-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:02 GMT
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
jot
www.civicscience.com/
0
0
Fetch
General
Full URL
https://www.civicscience.com/jot?j=1106764261.4090028691&n=1&s=poll&t=templates&d=%7B%22target%22%3A1567%2C%22natures%22%3A%5B%22ui-classic%22%2C%22iframe-wrapper%22%2C%22rootbeer-enabled%22%5D%2C%22instance%22%3A%22civsci-id-644047001%22%2C%22isContainerSeen%22%3Atrue%2C%22context%22%3A%22%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%2C%22wx%22%3A0%2C%22wy%22%3A0%2C%22wh%22%3A1200%2C%22ww%22%3A1600%2C%22cx%22%3A15%2C%22cy%22%3A818%2C%22st%22%3A%22EVPP%22%2C%22stg%22%3A%22EVPP%3BEVVP%22%2C%22session%22%3A%22a98a3cd0-73a2-11eb-9bad-cb2bc3a4695c%22%2C%22locale%22%3A%22en%22%2C%22alias%22%3A%22random%2F791983267.2004709293%22%7D
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.81.50.0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache/2.4.39 (Amazon) /
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:03 GMT
last-modified
Fri, 30 Aug 2019 14:44:32 GMT
server
Apache/2.4.39 (Amazon)
accept-ranges
bytes
etag
"0-59156a8fe3400"
content-length
0
content-type
text/plain; charset=UTF-8
jot
www.civicscience.com/
0
0
Fetch
General
Full URL
https://www.civicscience.com/jot?j=1106764261.4090028691&n=2&s=poll&t=served&d=%7B%22target%22%3A1567%2C%22natures%22%3A%5B%22ui-classic%22%2C%22iframe-wrapper%22%2C%22rootbeer-enabled%22%5D%2C%22instance%22%3A%22civsci-id-644047001%22%2C%22isContainerSeen%22%3Atrue%2C%22context%22%3A%22%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%2C%22wx%22%3A0%2C%22wy%22%3A0%2C%22wh%22%3A1200%2C%22ww%22%3A1600%2C%22cx%22%3A15%2C%22cy%22%3A818%2C%22askable%22%3A%22250021%22%2C%22usage%22%3A%22engagement%22%2C%22position%22%3A0%2C%22questions%22%3A%5B%22250021%22%5D%2C%22session%22%3A%22a98a3cd0-73a2-11eb-9bad-cb2bc3a4695c%22%2C%22alias%22%3A%22random%2F791983267.2004709293%22%2C%22locale%22%3A%22en%22%7D
Requested by
Host: www.civicscience.com
URL: https://www.civicscience.com/jspoll/4/civicscience-widget.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.81.50.0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache/2.4.39 (Amazon) /
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:03 GMT
last-modified
Fri, 30 Aug 2019 14:44:32 GMT
server
Apache/2.4.39 (Amazon)
accept-ranges
bytes
etag
"0-59156a8fe3400"
content-length
0
content-type
text/plain; charset=UTF-8
backing.gif
bluellipse.advertserve.com/images/control/tile/ Frame 5818
961 B
1 KB
Image
General
Full URL
https://bluellipse.advertserve.com/images/control/tile/backing.gif
Requested by
Host: bluellipse.advertserve.com
URL: https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.10.29.123 New Westminster, Canada, ASN36483 (GOSSAMERTHREADS, CA),
Reverse DNS
Software
nginx /
Resource Hash
75259e6f17039b8c1604db8f42ac5273fb7c758fae0be047ff59843d600c3f45

Request headers

Referer
https://bluellipse.advertserve.com/servlet/view/banner/url/zone?zid=7&pid=7&date=1613842801999
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Last-Modified
Thu, 15 Nov 2018 16:16:02 GMT
Server
nginx
ETag
W/"961-1542298562000"
Content-Type
image/gif
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
961
Expires
Sun, 21 Feb 2021 17:40:03 GMT
bid
c.amazon-adsystem.com/e/dtb/
112 B
506 B
XHR
General
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=3416&u=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&pid=I2SjNXYYd0xpC&cb=0&ws=1600x1200&v=7.59.00&t=2000&slots=%5B%7B%22sd%22%3A%22ad-648577%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x30%22%2C%22970x250%22%2C%22970x90%22%5D%7D%2C%7B%22sd%22%3A%22ad-648581%22%2C%22s%22%3A%5B%22%22%5D%7D%2C%7B%22sd%22%3A%22ad-648580%22%2C%22s%22%3A%5B%22%22%5D%7D%2C%7B%22sd%22%3A%22ad-648578%22%2C%22s%22%3A%5B%22%22%5D%7D%2C%7B%22sd%22%3A%22ad-648634%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%7D%2C%7B%22sd%22%3A%22ad-648632%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%7D%2C%7B%22sd%22%3A%22ad-648576%22%2C%22s%22%3A%5B%22728x90%22%5D%7D%5D&cfgv=0&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.24.128 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
f97dd4acde48a52d05105ad2cb9baef7693ef320c525bc09365fa173606aa332

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
server
Server
x-amz-cf-pop
ZAG50-C1
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
123
via
1.1 384bf15c1ac91d451725d766417680b1.cloudfront.net (CloudFront)
x-amz-cf-id
S2Sh5l_tHyBBAOkjbt1zkcgqYV_DtI7q4n_sd8bvIhmN6MJzYnqkxA==
southbendtribune
content.readefined.com/t/
76 B
173 B
Script
General
Full URL
https://content.readefined.com/t/southbendtribune?rwref=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&v=1
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.54.243.67 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-243-67.compute-1.amazonaws.com
Software
nginx / PHP/7.1.12
Resource Hash
ceb88b38d41017c53b6515afdfea327647a08a1dca59dda29230f55b102f018f

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:03 GMT
server
nginx
x-powered-by
PHP/7.1.12
content-type
javascript/text
ads
securepubads.g.doubleclick.net/gampad/
26 KB
8 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=393476010550399&correlator=858620995911963&output=ldjh&impl=fifs&adsid=NT&eid=21068773%2C21068891%2C31060075%2C21069731%2C44734255&vrg=2021021101&ptt=17&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20210220&iu_parts=172434654%2Csci.sbtnp%2Cnews%2Cbusiness&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3&prev_iu_szs=728x90%7C970x30%7C970x250%7C970x90%2C300x250%7C300x600%2C300x250%7C300x600%2C728x90%2C1x1&ists=1&prev_scp=pos%3Dt%26amznbid%3D2%26amznp%3D2%7Cpos%3D1%26amznbid%3D2%26amznp%3D2%7Cpos%3D3%26amznbid%3D2%26amznp%3D2%7Cpos%3Db%26amznbid%3D2%26amznp%3D2%7C&eri=1&cust_params=k%3Dinterlogic%2520outsourcing%252Cioi%252Ckeybank%252Ccivil%2520lawsuit%252Celkhart%252Cpayroll%2520processing%252Cfraud%252Ccleveland%252Cohio%252Cindiana%26page%3Dasset%252Carticle%252Capp-editorial&cookie_enabled=1&bc=31&abxe=1&lmt=1565647867&dt=1613842804180&dlt=1613842800175&idt=811&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1010%2C1010%2C230%2C230&adys=136%2C484%2C2011%2C2784%2C2914&adks=3273727798%2C1467293519%2C1467293517%2C3839857176%2C856545908&ucis=1%7C2%7C3%7C4%7C5&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x90%7C360x250%7C360x-1%7C1140x90%7C1140x1&msz=1600x90%7C360x250%7C360x-1%7C1140x90%7C1140x1&ga_vid=380505622.1613842800&ga_sid=1613842804&ga_hid=1106062857&fws=4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C360%2C1600%2C1600
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
29f98646ab2ec9c6d0789b495f254869d56731d6692c673c9f91b3f6746d6399
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7744
x-xss-protection
0
google-lineitem-id
4669956201,5607811100,4669733033,4669956201,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138233062342,138340273142,138233011907,138233062339,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
4d99f37e7c8dc25469e4f8c942572412.safeframe.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://4d99f37e7c8dc25469e4f8c942572412.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cookie set iu3
aax-eu.amazon-adsystem.com/s/ Frame B32A
Redirect Chain
  • https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5
  • https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5&dcc=t
234 B
926 B
Document
General
Full URL
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5&dcc=t
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.95.124.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
00942e0cdc43e061476ed7e78e12bfe1f5e6d36b5ea4f36515a9766b27b07984

Request headers

Host
aax-eu.amazon-adsystem.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.southbendtribune.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
ad-id=A2M6EdnzoEuWtDTcoNmzlsU|t
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

Server
Server
Date
Sat, 20 Feb 2021 17:40:04 GMT
Content-Type
text/html;charset=ISO-8859-1
Content-Length
189
Connection
keep-alive
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Set-Cookie
ad-id=A2M6EdnzoEuWtDTcoNmzlsU; Domain=.amazon-adsystem.com; Expires=Fri, 01-Oct-2021 17:40:04 GMT; Path=/; Secure; HttpOnly; SameSite=None ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Wed, 01-Apr-2026 17:40:04 GMT; Path=/; Secure; HttpOnly; SameSite=None
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip

Redirect headers

Server
Server
Date
Sat, 20 Feb 2021 17:40:04 GMT
Content-Length
0
Connection
keep-alive
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5&dcc=t
Set-Cookie
ad-id=A2M6EdnzoEuWtDTcoNmzlsU|t; Domain=.amazon-adsystem.com; Expires=Fri, 01-Oct-2021 17:40:04 GMT; Path=/; Secure; HttpOnly; SameSite=None
Vary
User-Agent
view
securepubads.g.doubleclick.net/pcs/ Frame 279B
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst0wtfeMwosIYho_1ZnoyeUhYvTAvt1ff7KjvjTC2DEiprundrLMIMMUBC3qjgl3a6UM2LoW7YYXah_LEDkxV6oc4Kt-OSASpXdq9tF_-RWP09ppp6Uz3p0_1H8YKFoqWwTJC5aFuo3E4zz8Jhi4O9tRdTRBbQnmf54uy6th6sHl5ISUHuos0AEhpjTk_rE4LD1XCdI-ptp9RlYlUAJhj8_WXXOSnxBLj1rVqEOsPBMLeT6vwX9_91IhcfiH0rjzYmsr4l-QTHrmI-AUtHGjzvwCnVxL5ZaoadCA_4SIhrL5kK2qZY4SGEFE47ntNp2bnJO6Oqedn9lWw&sai=AMfl-YQh9SzNrQBHXaeBJ3yz3V49h9s1MyhJMoqhUKKhnHQUtG5-ReScw74ucxn-ESrLpJwVMytOQg3bgBEWqMeU0Z2mTcTfxva9mQVc1X_pjg5BUKY_dEYAxEYMA_QFZSQW&sig=Cg0ArKJSzJfeLbyPrPNDEAE&urlfix=1&adurl=
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:04 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
RenderAd.aspx
ads3.mthsense.com/ Frame 279B
8 KB
3 KB
Script
General
Full URL
https://ads3.mthsense.com/RenderAd.aspx?id=15144&width=728&height=90
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.215.88.166 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
20f1cd8f3a76ab0f2ec4de8c77345c65e155d67beeb6b6c6eb1aba3d8775a6ca

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:04 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/html; charset=utf-8
Cache-Control
private
Content-Length
2815
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 279B
107 KB
33 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae35469a2de645d561d555105d21f075e0469c83a7bd02ebc9547d4d5b616f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1613565156040306"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33368
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame FBE5
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvUIs3zyy1g1bZvB3fqo1jKYrCqlVKX6bhZZ4_PTwo10CVa6visFG8BunLA-Y3RCRW5IMzOfnkZhp582J1AQGpe9O9qhdN9TXn_kUvxplUlXlJRSM9Z6cbp8jles7HOezNy2T2nT680klv1nnzP8vm_NLl4AjOOsc8og_XbYBPL9X1X_Wyv5Pcpc-L7Bq9gHVmpDmhSCjvBxpOnjk8S31ttdKL99rwhZghjOR-D2Nj7Fk7KNUEQTK14vhalEfTFQS6cT92ntLPpJ0HpGH_HmJJoAVRPM1ov30pRNuVTlkqqHcx3a_GfS6oGPJfXSdRYo5ZSJSdz4wcrvw&sai=AMfl-YSqQ2ZmD6Cq3TO8nXnsf-Yki-xvVPrzhSEZne6gaDzc8p2kXZnb7JfyhCDYL7Frebyn3-s7lilfZuwvywsRU1Yoz2E1ola7GijCJBVdVVgqUPSVgAksVcbe8GsHcEp8&sig=Cg0ArKJSzP-Q09ssvDTVEAE&urlfix=1&adurl=
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:04 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
indexa.html
www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/ Frame 9E16
14 KB
3 KB
Document
General
Full URL
https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.62 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
e3bf7336d520f93c9c71e200ec5beffd6c3c0b1fef61e13c79e8b79e0ecb3c69

Request headers

:method
GET
:authority
www.gannett-cdn.com
:scheme
https
:path
/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

x-guploader-uploadid
ABg5-UxXIIf8COa9UqOKFELL2QhckclnOc8ORklc_06jPst_LnD3xf94Y3_I2Dvd1NRSgtmRYJxvejgXlgGop_A8jTkaR5Tw6g
expires
Sat, 20 Feb 2021 17:40:04 GMT
last-modified
Wed, 17 Feb 2021 17:17:13 GMT
etag
"1e06179cc5a2b06a81a9c9420c599b2d"
content-type
text/html
x-goog-hash
crc32c=CocW4A== md5=HgYXnMWisGqBqclCDFmbLQ==
x-goog-storage-class
MULTI_REGIONAL
server
UploadServer
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
cache-control
max-age=2592000
accept-ranges
bytes
date
Sat, 20 Feb 2021 17:40:04 GMT
age
0
vcl_data
4teo2sTrkRpe2BJzz4IyqE.237_19-6d0afcfcb2140bff9705edcdfa68baa0
timing-allow-origin
*
access-control-allow-origin
*
x-served-by
cache-bwi5170-BWI, cache-fra19156-FRA
x-cache
MISS, MISS
x-cache-hits
0, 0
x-timer
S1613842805.650901,VS0,VE143
vary
Accept-Encoding
content-length
2079
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame FBE5
107 KB
33 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae35469a2de645d561d555105d21f075e0469c83a7bd02ebc9547d4d5b616f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1613565156040306"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33368
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 9459
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstNzoyd5wfyXGjW-srT0WUQAr4ySn27y7bVOJG4cFVuh8Q4Nfwzo0SVCe6IJ-gjMeamfNb6Ipd8CtQbEJFBfDHWjEkesjY5Gh0N3OKqw1ew80gurpT2OT-6MV3ju50OCX41ZtTMKkYvmAeiMLTSPQjEU1JZ3B6TvZUAMYUhW2Dtrc5sINTFPIkK_l01UFZIgI0Vo4mV25uyqbYdd-j8MbTZXrlgDPweQkWAnb_ygRNyRy-3kywiO4LmIni9JscGX6-LRQHQl7pMYxGTQUnVWyig7EBXwHiLwr0ht83HoOHVl_Pl7JFbeb_1D3R-aiLCPqZ7eTRYy3rHWw&sai=AMfl-YSLe0ou5oAE3-W2zYwKIob5E7ikJzueA0Z7Hh4SgT1ImEK7s-nmVLJrH5yo1-3jj9C71mbQp35QiFrqe9-F0aT7FxW8w6KHUi8p_aVtya7JyziyKyboJ6ZZS8KFO4X1&sig=Cg0ArKJSzPGZ0OOWTMPXEAE&urlfix=1&adurl=
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:04 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
RenderAd.aspx
ads3.mthsense.com/ Frame 9459
8 KB
3 KB
Script
General
Full URL
https://ads3.mthsense.com/RenderAd.aspx?id=15146&width=300&height=600
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.215.88.166 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
7e18bafd1b8439527a37845ee66b6ccaba263e419de517da66db2b011646b7c5

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:04 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/html; charset=utf-8
Cache-Control
private
Content-Length
2843
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9459
107 KB
33 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae35469a2de645d561d555105d21f075e0469c83a7bd02ebc9547d4d5b616f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1613565156040306"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33368
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 1EB6
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvoDuVDYP0g2wn1EEGPakCTfO-wYSppyBaVsNybwI_V-pTGiq4NzdIqZY2NvwDcgMoqHuJIz-43715pgYMYznqlBRvGcl0tCbEO8MvYfac3-2TPkwhTkEy2V7_OKEbOge6RkNOus3WIoEykMoKZK7IgdB3_NpAxqeslVjTlohTidrm6dqrimfC1aRONO8jSvSIhaZQZiJ2nwmPWdVONcOt31u-Wq6Xd-OHvC1LELl5YBi3Yhvs8rmOe9NJn8UcNQGQH25nX3YI5NAcOKXFgoaNEJ2YszzPvnxbas0ZHFMAtg2kHXbacWg2A-mM_gNo88_XRO7OuMpPZVw&sai=AMfl-YQX6x4pzBgZyxCY3KYHIfvQ7bED7ZYZbf7wDTjEy5f2Kch693LEQImGJzjemfuuyJKY6r5YM7efBBOFreJDnBtK3TGo0tup6TTlnQv89aFRBzeIVOQPUZANoMKqBJGR&sig=Cg0ArKJSzJOzyE9mW90-EAE&urlfix=1&adurl=
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:04 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
RenderAd.aspx
ads3.mthsense.com/ Frame 1EB6
8 KB
3 KB
Script
General
Full URL
https://ads3.mthsense.com/RenderAd.aspx?id=15144&width=728&height=90
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.215.88.166 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
20f1cd8f3a76ab0f2ec4de8c77345c65e155d67beeb6b6c6eb1aba3d8775a6ca

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:04 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/html; charset=utf-8
Cache-Control
private
Content-Length
2815
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 1EB6
107 KB
33 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae35469a2de645d561d555105d21f075e0469c83a7bd02ebc9547d4d5b616f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1613565156040306"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33368
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
osd.js
www.googletagservices.com/activeview/js/current/
74 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1143bb5ae891056f59482184346b0fe47d8e95c9e0f159f023bf0f95ec45222d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1613565174175677"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28346
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
sodar
pagead2.googlesyndication.com/getconfig/
8 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021021101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f100e72604253769ec1c7e9ff64748c553852df5900e01bc47acaa5554396147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6478
x-xss-protection
0
pr
aax-eu.amazon-adsystem.com/s/v3/ Frame E68C
583 B
729 B
Document
General
Full URL
https://aax-eu.amazon-adsystem.com/s/v3/pr?exlist=rbd_ox-db5&fv=1.0&a=cm&cm3ppd=1
Requested by
Host: aax-eu.amazon-adsystem.com
URL: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5&dcc=t
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.95.124.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
0d1d19881d1527477a90c59dac5ac3a51acf2d8f7894e41cac9fce9c316b1226

Request headers

Host
aax-eu.amazon-adsystem.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5&dcc=t
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
ad-id=A2M6EdnzoEuWtDTcoNmzlsU; ad-privacy=0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_ox-db5&dcc=t

Response headers

Server
Server
Date
Sat, 20 Feb 2021 17:40:04 GMT
Content-Type
text/html;charset=ISO-8859-1
Content-Length
368
Connection
keep-alive
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
truncated
/ Frame FBE5
210 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1577e5f265357b01ec43709052640c1db82ea2f39c08474e8b8a1f3bdf910ba4

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1611170586013198"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6403
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame FBE5
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu73JEvU_nI5bK1Nxwhp4bvUqPK37U-SyW-cl3jtZNWurb5izrIJnnz_r95Vfm_Ev-aJ9q2xXw76quKXDCLuYvTlbIHXK10z_Tw1nhgkxbQ_Eo42KGt0322uWsWhHY3d2VVooEdWqu80gLNxO-F_skyXalA86UQ4yjvpadWSPa2zxIMBRQS_Ab_RiR-eb0Jh6wEyUQCh8WVooC66IH5QnI3k9YGwufeD79qIsN3vHIAy2HJqrbcxSndim6GwaBY35SOWSDRJW32j5G8R7aT6DKEwXJYU_DzFfA7cL-Bnk9B-6nkyiVDkcVhHvZTqU7m0czc5Unpu4UjtGpu&sai=AMfl-YTLpVnQM1DWgjyC-3_H7-Vd4VSXQIsWQu89pfQf7j_vqvQLo2Sj12CImS5tsKW28JxzRGRsrQ8jG4KI5CWpv0UOxPNxRC_fT3lAOe2hXU38tMd7Hkj6sH1Ul1gX4chL&sig=Cg0ArKJSzFrHAenKoQXFEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:04 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:04 GMT
usync.html
eus.rubiconproject.com/ Frame B3F9
291 B
559 B
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Requested by
Host: aax-eu.amazon-adsystem.com
URL: https://aax-eu.amazon-adsystem.com/s/v3/pr?exlist=rbd_ox-db5&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.108.50.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-50-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
4ddc003bfd0366a9c5e059509b3bac51972a8e803904b2a90b6b5c5ee7b26720

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Mon, 28 Sep 2020 17:02:39 GMT
ETag
"4000c-123-5b062a240e9c0"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
238
Content-Type
text/html; charset=UTF-8
Date
Sat, 20 Feb 2021 17:40:04 GMT
Connection
keep-alive
Vary
Accept-Encoding
cm
u.openx.net/w/1.0/ Frame C059
Redirect Chain
  • https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BO...
  • https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3...
628 B
727 B
Document
General
Full URL
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by
Host: aax-eu.amazon-adsystem.com
URL: https://aax-eu.amazon-adsystem.com/s/v3/pr?exlist=rbd_ox-db5&fv=1.0&a=cm&cm3ppd=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
86c555f09417120aabf0770704086130d11a779aea23384431accf628fd29dfc

Request headers

:method
GET
:authority
u.openx.net
:scheme
https
:path
/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=c80f4c58-7f97-093e-1f7c-25741bb8dbd4|1613842804
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

vary
Accept, Accept-Encoding
set-cookie
i=c80f4c58-7f97-093e-1f7c-25741bb8dbd4|1613842804; Version=1; Expires=Sun, 20-Feb-2022 17:40:04 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1613842804|gen0vNiygu; Version=1; Expires=Sun, 07-Mar-2021 17:40:04 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.202.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 20 Feb 2021 17:40:04 GMT
content-type
text/html
content-length
394
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

set-cookie
i=c80f4c58-7f97-093e-1f7c-25741bb8dbd4|1613842804; Version=1; Expires=Sun, 20-Feb-2022 17:40:04 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.202.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
date
Sat, 20 Feb 2021 17:40:04 GMT
content-length
0
via
1.1 google
alt-svc
clear
runner.html
tpc.googlesyndication.com/sodar/sodar2/221/ Frame EBA4
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/221/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
4984
date
Sat, 20 Feb 2021 16:57:53 GMT
expires
Sun, 20 Feb 2022 16:57:53 GMT
last-modified
Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
2531
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
pagead2.googlesyndication.com/bg/ Frame EBA4
14 KB
7 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fb73d5d93057e64e297129d2873fdd0fb83ea5dea63bf77cd87e9041af59dbc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 07:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 09 Feb 2021 09:15:00 GMT
server
sffe
age
207964
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6187
x-xss-protection
0
expires
Fri, 18 Feb 2022 07:54:00 GMT
adapt-2-3-0.js
www.gannett-cdn.com/gps/applications/adapt/scripts/ Frame 9E16
89 KB
31 KB
Script
General
Full URL
https://www.gannett-cdn.com/gps/applications/adapt/scripts/adapt-2-3-0.js
Requested by
Host: www.gannett-cdn.com
URL: https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.62 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
7243503d1dc0162827d84a0d2b4207d2ff4a5a773afef645434e5cdc852995ae

Request headers

Referer
https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
age
1595757
x-guploader-uploadid
ABg5-Uw_G6byZCnsUO7x3WCl6Q80e_hmrXuqwA84HTwOv2Sy8BG6LiRK0XrMLb7NZ4_5h7DH63SHkyd-4Ii641CD1w
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
content-length
30951
via
1.1 varnish, 1.1 varnish
x-served-by
cache-bwi5156-BWI, cache-fra19156-FRA
vcl_data
4teo2sTrkRpe2BJzz4IyqE.237_19-6d0afcfcb2140bff9705edcdfa68baa0
last-modified
Wed, 06 Jan 2021 04:28:02 GMT
server
UploadServer
x-timer
S1613842805.842785,VS0,VE1
etag
"ce3997efc3fb75b09f7a5037dc959392"
vary
Accept-Encoding
x-goog-hash
crc32c=6h11vA==, md5=zjmX78P7dbCfelA33JWTkg==
content-type
text/javascript
access-control-allow-origin
*
expires
Tue, 02 Feb 2021 06:24:08 GMT
cache-control
max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
x-cache-hits
1, 1
usync.js
eus.rubiconproject.com/ Frame B3F9
31 KB
10 KB
Script
General
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.108.50.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-50-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
16975092f2e5a9b12bce76ab1e822fa6d29f35bab6b36671391bff732414abe9

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:04 GMT
Content-Encoding
gzip
Last-Modified
Thu, 28 Jan 2021 20:32:24 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=37754
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9309
Expires
Sun, 21 Feb 2021 04:09:18 GMT
ecm3
aax-eu.amazon-adsystem.com/s/ Frame C059
43 B
344 B
Image
General
Full URL
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=openx.com&id=43750f7c-caba-8d33-85a4-6f0b17ac23c9
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.95.124.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Request headers

Referer
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:04 GMT
Server
Server
Vary
User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame C059
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=REXFlEZMwZFfFpOdShDbnEdNzpJfR5WRQBCSUqoU
43 B
180 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=REXFlEZMwZFfFpOdShDbnEdNzpJfR5WRQBCSUqoU
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:04 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:04 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=REXFlEZMwZFfFpOdShDbnEdNzpJfR5WRQBCSUqoU
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame C059
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=5817131199769861046
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=5817131199769861046
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:04 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=5817131199769861046
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame C059
70 B
265 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=1ba37301-d610-36c9-45aa-ed9c7f9fe829&gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.16.108.17 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:04 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame C059
170 B
752 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MzdjY2EwY2ItMWY2Ny02ODZkLTUwNGEtYjcyNWI1N2QyNjQ5
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.74.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame C059
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPVvRUEdcKBLG3CZl_64usc&google_cver=1
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPVvRUEdcKBLG3CZl_64usc&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:04 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:04 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPVvRUEdcKBLG3CZl_64usc&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adapt-2-3-0-tracking.js
www.gannett-cdn.com/gps/applications/adapt/scripts/ Frame 9E16
3 KB
2 KB
Script
General
Full URL
https://www.gannett-cdn.com/gps/applications/adapt/scripts/adapt-2-3-0-tracking.js
Requested by
Host: www.gannett-cdn.com
URL: https://www.gannett-cdn.com/gps/applications/adapt/scripts/adapt-2-3-0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.62 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
022c469c5d34fbf729b08680fef89c0e1171ea21e4f665c8032b5e77c34d5aa0

Request headers

Referer
https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:04 GMT
content-encoding
gzip
age
1593787
x-guploader-uploadid
ABg5-UzZkXFdH4PxeQYSWJ7v2wIIhxGnyt9SieG-qXiHdUw9tzK5y2PeTnb-LNTuvvo3TMcMdpp1D57eC7e0MDzktxwhyULG0Q
x-cache
HIT, HIT
x-goog-storage-class
MULTI_REGIONAL
content-length
1294
via
1.1 varnish, 1.1 varnish
x-served-by
cache-bwi5128-BWI, cache-fra19156-FRA
vcl_data
4teo2sTrkRpe2BJzz4IyqE.237_19-6d0afcfcb2140bff9705edcdfa68baa0
last-modified
Wed, 06 Jan 2021 04:28:01 GMT
server
UploadServer
x-timer
S1613842805.900303,VS0,VE1
etag
"ab24a5a9c6aef6da27e5d04c0381fcda"
vary
Accept-Encoding
x-goog-hash
crc32c=CQFBfA==, md5=qySlqcau9ton5dBMA4H82g==
content-type
text/javascript
access-control-allow-origin
*
expires
Tue, 02 Feb 2021 06:56:57 GMT
cache-control
max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
x-cache-hits
1, 1
khaos.jpg
token.rubiconproject.com/ Frame B3F9
284 B
921 B
Image
General
Full URL
https://token.rubiconproject.com/khaos.jpg?
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
284
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Content-Type
image/jpg
event
traxex.gannettdigital.com/ Frame 9E16
35 B
202 B
Image
General
Full URL
https://traxex.gannettdigital.com/event?id=b94aa3d1-3bb5-5810-a11b-64507dfb4b07&type=impression&adapt_id=a&cb=345845985&dsp_advertiser=302854334&dsp_campaign=2814354381&dsp_creative=138340273142&dsp_name=gam&order_mgmt_id=934309-1001&order_mgmt_name=orderhub&orientation=landscape&platform=desktop&size=300x250&site=southbendtribune.com
Requested by
Host: www.gannett-cdn.com
URL: https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.207.62 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
via
1.1 google
x-content-type-options
nosniff
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
alt-svc
clear
content-length
35
x-xss-protection
0
css
fonts.googleapis.com/ Frame 9E16
865 B
553 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Dancing+Script:700%7CRoboto:700,900&text=Orignal%20RecpLotFmyS713E.JfsBvd%E2%80%A228-49%240WD%26ATHUY()Pzk
Requested by
Host: www.gannett-cdn.com
URL: https://www.gannett-cdn.com/gps/applications/adapt/scripts/adapt-2-3-0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b4a9815e6597f872af26e1ac2bd51654f62ef8fcd2faf4b299f56cacb49bdf76
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 17:40:04 GMT
server
ESF
date
Sat, 20 Feb 2021 17:40:04 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 20 Feb 2021 17:40:04 GMT
readerschoice-image-ue48vh_layout1.png
www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/ Frame 9E16
86 KB
86 KB
Image
General
Full URL
https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/readerschoice-image-ue48vh_layout1.png?cb=ksNqVksW
Requested by
Host: www.gannett-cdn.com
URL: https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.62 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
22ddb28c8ce1b967dfae532a43fa4cb4ca658bcf24d83f8310f0f61ef2a23acd

Request headers

Referer
https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
via
1.1 varnish, 1.1 varnish
age
32383
x-guploader-uploadid
ABg5-Uz5Ub8hordhDOTROLco47JFo0pL47AGKUs9MrKg3CHwv7memorhkkaPwz7ptezivaqsHo8GxP1q3uknyrThB0JfWQryYQ
x-cache
HIT, MISS
fastly-io-info
ifsz=116315 idim=226x307 ifmt=png ofsz=87658 odim=226x307 ofmt=webp
x-goog-storage-class
MULTI_REGIONAL
fastly-stats
io=1
content-length
87658
x-served-by
cache-bwi5131-BWI, cache-fra19156-FRA
vcl_data
4teo2sTrkRpe2BJzz4IyqE.237_19-6d0afcfcb2140bff9705edcdfa68baa0
server
UploadServer
x-timer
S1613842805.966217,VS0,VE95
etag
"IWeNXnYqZid9eXhv/qvbg89I3/CZLmqDGAU7F2i+53Y"
vary
Accept
x-goog-hash
crc32c=Y9auCg==, md5=w3PWbtq6OBqDw98KNmCc/Q==
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 20 Feb 2021 08:40:21 GMT
cache-control
max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
x-cache-hits
1, 0
barnabys-image-vgec6v_layout1.jpg
www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/ Frame 9E16
13 KB
13 KB
Image
General
Full URL
https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/barnabys-image-vgec6v_layout1.jpg?cb=lI5gvfSh
Requested by
Host: www.gannett-cdn.com
URL: https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.62 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
01ac884ecbe6cf1fe700eb7ea09a11c584ff1c4e0d69bc06c558b3bddb74f8d6

Request headers

Referer
https://www.gannett-cdn.com/gps/applications/adapt/published/2021/02/barnabys-restaurant/sb-934309-1001/indexa.html?dspAdvertiser=302854334&dspCampaign=2814354381&dspCreative=138340273142&dspName=gam&o=345845985&site=southbendtribune.com&turl=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstrNeq9y45cxFUEP3_8rjk_ANs3M5geSqM3Q9qf14rdCrUnV2FZLFcOp-iB_d4B9Dwh628LrebDQAcmvGxibZ9VMTNsCsYkYiMpywKUu7F0HPAyZ_mnolM44WTCHF33UfwR2Oifvoit-LBiCJXU6oBTtKiRwKFw-j8jM0I_TMoLxanfBugkNUmU88ecI_8IuOMbv80cHlWu6aJEK9JOzOy0pCt3Na7g4FkUXx4plEVIqyM-fx_IPAoiady74FTFy_3PvhMNYaIKmcy4X27ZEnJviYXZMagnn5dXtK9gsgqHGAZhYVMwacdPtcyLRd9B0Gf-muodCQ%2526sai%253DAMfl-YSJxRGbzY8S0S8wd2xH7l5Dj64qNU5PzFRHIYl4BrKNkef2NrFfzCztIo-Tvuu2U1a8uuKYRbm_oN6hC3FscD99m4LRVsj-HFYgpcSlW6es7yJKkfXgJSwtddjY4bev%2526sig%253DCg0ArKJSzDTl7BoATb-NEAE%2526urlfix%253D1%2526adurl%253D&utm_campaign=usat_network&utm_medium=display&utm_source=localiq&ct=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
via
1.1 varnish, 1.1 varnish
age
36056
x-guploader-uploadid
ABg5-UyivHLgaPHZGsKjDbZMUCQhzeoqTCiUOUeOPhGD0Dw508LQEibBcT88z9CeaLAtwkRnjC0E7nkSjAjffuEbhY67XwZYlw
x-cache
HIT, MISS
fastly-io-info
ifsz=93548 idim=186x224 ifmt=jpeg ofsz=13188 odim=186x224 ofmt=webp
x-goog-storage-class
MULTI_REGIONAL
fastly-stats
io=1
content-length
13188
x-served-by
cache-bwi5162-BWI, cache-fra19156-FRA
vcl_data
4teo2sTrkRpe2BJzz4IyqE.237_19-6d0afcfcb2140bff9705edcdfa68baa0
server
UploadServer
x-timer
S1613842805.966225,VS0,VE91
etag
"v4cXs37kZW1NzrvM5OMaZJngHCYjvnrAd13pcaiLkeo"
vary
Accept
x-goog-hash
crc32c=2DxQRg==, md5=FX26zezaPbCTWY4KXWZShg==
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 20 Feb 2021 07:39:08 GMT
cache-control
max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
x-cache-hits
1, 0
font
fonts.gstatic.com/l/ Frame 9E16
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/l/font?kit=If2cXTr6YS-zF4S-kcSWSVi_sxjsohD9F50Ruu7B1i0HTuB9ptHip3Z7lJ90c9NSb9NPqUKtvWJG4gIyccSJKiwNCeD8EsTPrU8l6gLDjqsD94-WKBW4ejyfCSU_e9g&skey=c89f400061e5d0a8&v=v16
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Dancing+Script:700%7CRoboto:700,900&text=Orignal%20RecpLotFmyS713E.JfsBvd%E2%80%A228-49%240WD%26ATHUY()Pzk
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b8fc8be3027f8bc886e240a13148d9f86a50b22cdb451eb5be318775fcb507be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Origin
https://www.gannett-cdn.com
Referer
https://fonts.googleapis.com/css?family=Dancing+Script:700%7CRoboto:700,900&text=Orignal%20RecpLotFmyS713E.JfsBvd%E2%80%A228-49%240WD%26ATHUY()Pzk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
x-content-type-options
nosniff
last-modified
Sat, 30 Jan 2021 06:14:59 GMT
server
ESF
x-frame-options
SAMEORIGIN
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="font.woff"; filename*=UTF-8''font.woff
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11028
x-xss-protection
0
expires
Sun, 21 Feb 2021 17:40:05 GMT
font
fonts.gstatic.com/l/ Frame 9E16
5 KB
5 KB
Font
General
Full URL
https://fonts.gstatic.com/l/font?kit=KFOlCnqEu92Fr1MmWUlvBh0_IsHAoKhqXVOdLHcvUgbrbtE0FwjR7EqY3hZqkD9kgC8iup6hJpSPJUdSW6fpufht4HPyegroTP6y&skey=c06e7213f788649e&v=v20
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Dancing+Script:700%7CRoboto:700,900&text=Orignal%20RecpLotFmyS713E.JfsBvd%E2%80%A228-49%240WD%26ATHUY()Pzk
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
dce41d8f83bbbd8af7eb7e423c8e4266323a962c66ed3a3fde0db364620549dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Origin
https://www.gannett-cdn.com
Referer
https://fonts.googleapis.com/css?family=Dancing+Script:700%7CRoboto:700,900&text=Orignal%20RecpLotFmyS713E.JfsBvd%E2%80%A228-49%240WD%26ATHUY()Pzk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 16:27:37 GMT
server
ESF
x-frame-options
SAMEORIGIN
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="font.woff2"; filename*=UTF-8''font.woff2
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4732
x-xss-protection
0
expires
Sun, 21 Feb 2021 17:40:05 GMT
font
fonts.gstatic.com/l/ Frame 9E16
5 KB
5 KB
Font
General
Full URL
https://fonts.gstatic.com/l/font?kit=KFOlCnqEu92Fr1MmYUtvBh0_IsHAoKhqXVOdLHcvUgbrbtE0FwjR7EqY3hZqkD9kgC8iup6hJpSPJUdSW6fpufht4HPyegroTP6y&skey=934406f772f9777d&v=v20
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Dancing+Script:700%7CRoboto:700,900&text=Orignal%20RecpLotFmyS713E.JfsBvd%E2%80%A228-49%240WD%26ATHUY()Pzk
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d2d1cf462daf535c71bc7ad96b7d2c775468299e7ad18a286d73376d3ac7f7f0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Origin
https://www.gannett-cdn.com
Referer
https://fonts.googleapis.com/css?family=Dancing+Script:700%7CRoboto:700,900&text=Orignal%20RecpLotFmyS713E.JfsBvd%E2%80%A228-49%240WD%26ATHUY()Pzk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 16:27:37 GMT
server
ESF
x-frame-options
SAMEORIGIN
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="font.woff2"; filename*=UTF-8''font.woff2
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4732
x-xss-protection
0
expires
Sun, 21 Feb 2021 17:40:05 GMT
gen_204
pagead2.googlesyndication.com/pagead/
0
224 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021021101&jk=393476010550399&bg=!mZqlmtnNAAXRs2QT0TsAKQB2-DxaIJhxk8IWQx7pM6IyJDS8qp3MucxgrbdPU7senPjyIW4mC1PeAgAAAJ5SAAAAFWgBBwoBJqyGrV7DJC7zB5s_6IfCPk4uHwcXLov8QHya5Lf-DQ_xHwTdz7TeKmn-H4UGasSDR1cAYIw4M_1SUwT9rsqjQqWsJNo9mpOsISRpY1DypZDVwqn6sdFvmqarmajRnXB3MOhDxph5E3NThMnJXWt8-TFyzCWF2WOzii8a97twWUJw1JB7TLh4jlCVWnbTSuSAuKKWbiW9N9qtwrvI6VewbQuzu60Qboyc5h083MSoL-tw7jz8o0KMEPLZi_CBY3lyiKCgpPeY247Oe7EZBKXIHBd2m4AB5503-YnX03vO4vsCNpcP2gLkz_a818PUBGErZjjYQI6V34gO9ChplNRGKs3O-uGrzVuUkgWGiiXrytos2sW-hMozJ83ihKbXMqvg9zn4F201GJkB3Sv3IBv-3vlj8GM4jmc9JvvYVKbeFmT3PrlyWNkTjKQf9wGz-Lpm7g6ZA9AJxzuba1chyT1g8f5RNs1pnBq9opYczOJLYTGKVOU6Ug236mijJUg0Tcur0-iC9syuGi6Dj4abQbPMs5C6zm00O1c05YaOfUjcdeKR2MzijFHjns-C27ImahMQd0Y-8kBMLFRFoIbzEUOBUg0bipgOrNlnrBc8YrNtae4Cu8Eku6myRRGuVfSpHoXgODiq3EE19xRmwUeGwGnjkddz4BJfDfZ5vbQs3wIBKF9ZlYML4dY9dWRXi1erGU8cXiFICI5D9YfKE8djhIfRsy-9ZeiQ-H68frg53Sjq60X_oFPyFhwrJK4FbBcnype_hrZ_tBpDygvYajwolnYzMsuAKyZ-d4D3nPfqBJb0mUC2CayscvqZG2kOLTB-1Zz_7QmioQsFujeOIw0iQipcXS-zMAJ8CAQcKzTVh-12JPaXr5hH1OQv9VddNKNsDcO4cEbpfaR8eg3sbh__3BpbLo96e6fKAOgwy4goBnx5J-H6OKNoHhtjFXnN8KglA7vl4fsX4uBFAUh7-zlDMohgu7ZYRjoyxQipGTc9_tCi4bcz0YdOz3en4HpCO31T0sn_qnR4DzU-4w
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ecm3
aax-eu.amazon-adsystem.com/s/ Frame B3F9
Redirect Chain
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=a9eu
  • https://aax-eu.amazon-adsystem.com/s/ecm3?id=KLE0C5XF-8-A3SZ&ex=d-rubiconproject.com&status=ok
43 B
344 B
Image
General
Full URL
https://aax-eu.amazon-adsystem.com/s/ecm3?id=KLE0C5XF-8-A3SZ&ex=d-rubiconproject.com&status=ok
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.95.124.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:05 GMT
Server
Server
Vary
User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://aax-eu.amazon-adsystem.com/s/ecm3?id=KLE0C5XF-8-A3SZ&ex=d-rubiconproject.com&status=ok
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
611afce88997db6fdd35eb213e662871
Expires
0
pixel
cm.g.doubleclick.net/ Frame B3F9
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S0xFMEM1WEYtOC1BM1Na
170 B
201 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S0xFMEM1WEYtOC1BM1Na
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S0xFMEM1WEYtOC1BM1Na
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
ack
cookiex.ngd.yahoo.com/ Frame B3F9
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KLE0C5XF-8-A3SZ&sigv=1&esig=2~c383b552c8d999ae1dea1a614121dc2908e9206d
  • https://cookiex.ngd.yahoo.com/ack?xid=E0&eid=KLE0C5XF-8-A3SZ
0
22 B
Image
General
Full URL
https://cookiex.ngd.yahoo.com/ack?xid=E0&eid=KLE0C5XF-8-A3SZ
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
p3p
policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff

Redirect headers

date
Sat, 20 Feb 2021 17:40:05 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
p3p
policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location
https://cookiex.ngd.yahoo.com/ack?xid=E0&eid=KLE0C5XF-8-A3SZ
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
rubicon
match.adsrvr.org/track/cmf/ Frame B3F9
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/rubicon
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.16.108.17 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame B3F9
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmNkZmMyMTExMGM2Y2ZjOWZkMjZkYmEwOTdmYTFlNjk5ZTU3ZGQ1ZA
170 B
190 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmNkZmMyMTExMGM2Y2ZjOWZkMjZkYmEwOTdmYTFlNjk5ZTU3ZGQ1ZA
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmNkZmMyMTExMGM2Y2ZjOWZkMjZkYmEwOTdmYTFlNjk5ZTU3ZGQ1ZA
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame B3F9
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=fa046031-4974-4c00-b096-c7a8abf87be8
42 B
678 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=fa046031-4974-4c00-b096-c7a8abf87be8
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Content-Type
image/gif

Redirect headers

Date
Sat, 20 Feb 2021 17:40:03 GMT
Server
MT3 3518 2f03077 master zrh-pixel-x9
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=fa046031-4974-4c00-b096-c7a8abf87be8
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sat, 20 Feb 2021 17:40:02 GMT
tap.php
pixel.rubiconproject.com/ Frame B3F9
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEAVeQwrJOHhDYBuMPayEVww&google_cver=1
42 B
678 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEAVeQwrJOHhDYBuMPayEVww&google_cver=1
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEAVeQwrJOHhDYBuMPayEVww&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame B3F9
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&_test=YDFJdQAAALzdOjoG
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YDFJdQAAALzdOjoG&_test=YDFJdQAAALzdOjoG
42 B
678 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YDFJdQAAALzdOjoG&_test=YDFJdQAAALzdOjoG
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
via
1.1 varnish
server
Varnish
x-timer
S1613842805.385534,VS0,VE0
x-served-by
cache-hhn4048-HHN
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YDFJdQAAALzdOjoG&_test=YDFJdQAAALzdOjoG
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
709414.gif
id.rlcdn.com/ Frame B3F9
0
66 B
Image
General
Full URL
https://id.rlcdn.com/709414.gif
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.207.148 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=a9eu&endpoint=eu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
via
1.1 google
alt-svc
clear
content-length
0
prebid4.7.0.js
storage.googleapis.com/rs-static/ Frame 3595
302 KB
302 KB
Script
General
Full URL
https://storage.googleapis.com/rs-static/prebid4.7.0.js
Requested by
Host: ads3.mthsense.com
URL: https://ads3.mthsense.com/RenderAd.aspx?id=15144&width=728&height=90
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
40f94d4bff7ccb6896e68d0b94d486b89aa3f7a46bc753a120fab954e636a573

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:33:08 GMT
age
417
x-guploader-uploadid
ABg5-Uz0dbrYMwgmdSkW2SQd98hJHAnmXwQTKpMcerC2kQbMYkDOosFH6e0-txRapkK4WTolgV7wewEpAjtjeZfilBA
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
309272
last-modified
Tue, 15 Sep 2020 19:30:03 GMT
server
UploadServer
etag
"6093877422c034fe300df8ed44d1e948"
x-goog-hash
crc32c=t+/UZw==, md5=YJOHdCLANP4wDfjtRNHpSA==
x-goog-generation
1600198203919898
cache-control
public, max-age=3600
x-goog-stored-content-length
309272
accept-ranges
bytes
content-type
text/javascript
expires
Sat, 20 Feb 2021 18:33:08 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 3595
57 KB
19 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a06af446be30cdc4a1b9c4481b813722163853b764fe4f1dcff1468662edaddd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"789 / 68 of 1000 / last-modified: 1613776162"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19523
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
truncated
/ Frame 279B
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2a2476bbf2625cd8bda438b8b79933328f519e098f6e4aa1f6a692ef207c66c

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 279B
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstZAxRsO9Y50Q56qGGpwUBDNVac-4dTv9PrQKrql582a5MxutwTvnjrqczIyRa5J6hXfJlHp2CYbyINaNeetNwlC4ja6besu7emiZZ35RhPDai82n1x2e0g_5SDnEymnCOcC_g5b4uq4POyD2k-RRzv16pJfpeFXvxzhFUYEXFH1L_uwB_gHHW0gAnIqcxS1CpbphSV_FO-3QrCVfJUbRts_z0A6-NgKn-PMOTCUXDgSZHUQVZmQ-Pqwq648fF65i0Y4om2q0pCmW9g0uNbsoOfBuq76bq8JXf_h1fiH1pyGvS5d66HIDcS8RH_zt72nC8DdY6DfiggDn2U&sai=AMfl-YQbJsbAwZQHqP4ZYisFBCZPu-H9uGn2ufY5YyCGPTsgeCnuJyIyKOaN17IOL7kqi2E8Ld59VG3P7c3UkpKHEZVJXtLNo7AwMXdZndImTrRDmjKuJHSSJVxggZ6-YC_G&sig=Cg0ArKJSzEjOofLv6aE_EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
prebid4.7.0.js
storage.googleapis.com/rs-static/ Frame 895A
302 KB
303 KB
Script
General
Full URL
https://storage.googleapis.com/rs-static/prebid4.7.0.js
Requested by
Host: ads3.mthsense.com
URL: https://ads3.mthsense.com/RenderAd.aspx?id=15146&width=300&height=600
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
40f94d4bff7ccb6896e68d0b94d486b89aa3f7a46bc753a120fab954e636a573

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 16:44:27 GMT
age
3338
x-guploader-uploadid
ABg5-UxcUatqqfsWS_u52tFEFmvNP6BH-d1kuKhp6Or5MEYkZgJUBWX7nj1AgVWN5V9qnxvqs34ambYtpdXco48u0G4
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
309272
last-modified
Tue, 15 Sep 2020 19:30:03 GMT
server
UploadServer
etag
"6093877422c034fe300df8ed44d1e948"
x-goog-hash
crc32c=t+/UZw==, md5=YJOHdCLANP4wDfjtRNHpSA==
x-goog-generation
1600198203919898
cache-control
public, max-age=3600
x-goog-stored-content-length
309272
accept-ranges
bytes
content-type
text/javascript
expires
Sat, 20 Feb 2021 17:44:27 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 895A
57 KB
19 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a06af446be30cdc4a1b9c4481b813722163853b764fe4f1dcff1468662edaddd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"789 / 530 of 1000 / last-modified: 1613776162"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19523
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
truncated
/ Frame 9459
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
51e52fb8e215c4a19cf2e31d4916ef72152e5b03f1a83c8c8493945664bc055e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
prebid4.7.0.js
storage.googleapis.com/rs-static/ Frame 5A08
302 KB
302 KB
Script
General
Full URL
https://storage.googleapis.com/rs-static/prebid4.7.0.js
Requested by
Host: ads3.mthsense.com
URL: https://ads3.mthsense.com/RenderAd.aspx?id=15144&width=728&height=90
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
40f94d4bff7ccb6896e68d0b94d486b89aa3f7a46bc753a120fab954e636a573

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 16:44:27 GMT
age
3338
x-guploader-uploadid
ABg5-UxcUatqqfsWS_u52tFEFmvNP6BH-d1kuKhp6Or5MEYkZgJUBWX7nj1AgVWN5V9qnxvqs34ambYtpdXco48u0G4
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
309272
last-modified
Tue, 15 Sep 2020 19:30:03 GMT
server
UploadServer
etag
"6093877422c034fe300df8ed44d1e948"
x-goog-hash
crc32c=t+/UZw==, md5=YJOHdCLANP4wDfjtRNHpSA==
x-goog-generation
1600198203919898
cache-control
public, max-age=3600
x-goog-stored-content-length
309272
accept-ranges
bytes
content-type
text/javascript
expires
Sat, 20 Feb 2021 17:44:27 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 5A08
57 KB
19 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a06af446be30cdc4a1b9c4481b813722163853b764fe4f1dcff1468662edaddd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"789 / 666 of 1000 / last-modified: 1613776162"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19523
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
truncated
/ Frame 1EB6
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef787f20e35b5b6a5c86e4089d1aa889756293bca5dc1c4af8605693ecdb1c76

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 9459
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstc4dh97hg79jjLQcoFukKYNOz0_N0B8PjfLGM_EI3KJHy8RzdWAiP1E5u4HBNK5KIyVmydmZQ3y6cGRhb99tMhFWkFVyjOnHm-JKWplOLGZmxP5ObXnhJfzgsoEcxba4fHDW5i_XII2OFToQ2PZgn4vBmUiElnWYWwBzt9JnrzxRjsRF-ZkSMLYrt4LIOhSg9LFCzAZkKUwfToZW2_ldf2Vxe2eS1tpaAN3hLV1uGCvt9THAHkHrRxhEAXgrq5GAOonhYftiJ3zcX67HVz6wk1oq9jlFCRskHXcS3wDoMAD4FQnZ3EPHDdbeCkY8aKp47KofcruhZGwPjd&sai=AMfl-YTGHYHsnNAQZTKfiyFldP95nc531KqRD4teKW2GF5KqkKjffz4_JDZqTjxDcTERoY_m-Vr4EdbkUHdEng7lngoVzygFE-DyDQg3kOR9z00g2S5QuHWzFQ-Pn-61ZK0v&sig=Cg0ArKJSzG72XmPrUyXZEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 1EB6
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvIjbLjBwBsRJ21xctkcu_55tfOsg1Fn0-Ez5PFkYVMTDPArrtwZPQA4sBX7DWdi1YDZuxgrMaVmCkcml9dcalKYTFx9XhE7ODB5QVFkdGTBGtTpygTBpThX_-TiuN6Ggetsii0desN7qhHIi6nqObG22-V9g7drZnygPvsUlzOSU2iH31pcHx2aNiF55A7AAWEioHCxjc4u8U9pAcCOQFeW0Aj1gWqkOYeAaPENfL0uOGgvDAYz_3Z6cJGJcuN2p7Ul91xDz9garG1umUXOiRPae0qtuBlOiR9vNScDj5r1XQ4QwU0vfOR708xZkH4pZCbbaU4pvhXOZ0e&sai=AMfl-YQzpOnZaRzVPj8qacqXMeewfR3CQAMNNPm6Rcsc-nV1M9hiaRRlyp11w3qVnxo1LF0DVLx9WFjVL83Pj-XMygCYyWU_xq_s-GnCP_dM9TnygH2yAozNMuNOYlbaMbDh&sig=Cg0ArKJSzHqfWyLSpgT5EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
pubads_impl_2021021101.js
securepubads.g.doubleclick.net/gpt/ Frame 3595
289 KB
101 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
sffe /
Resource Hash
a533e6ac10f159c258a7737b2a63378e910622fcc61e6c90be14d6d95328fb64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Feb 2021 09:38:54 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
103545
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
hb
ssc.33across.com/api/v1/ Frame 3595
65 B
635 B
XHR
General
Full URL
https://ssc.33across.com/api/v1/hb?guid=bFNDkc19ir6ikyaKkGJozW
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.4.152.106 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-152-106.compute-1.amazonaws.com
Software
/ 33Across
Resource Hash
125898ed8c69e133e70ecdfd61e0aff857c03e441bdabb983ec3c5435ab6b926

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-credentials
true
bid
ap.lijit.com/rtb/ Frame 3595
24 B
641 B
XHR
General
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.7.0
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx /
Resource Hash
69f63acb505c4500095445a0cfe9dd69d76e49a9c136084cb582822f5042c95b

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sat, 20 Feb 2021 17:40:05 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://www.southbendtribune.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap1ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
prebid
ib.adnxs.com/ut/v3/ Frame 3595
19 B
722 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:05 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.117:80
AN-X-Request-Uuid
ffd7c199-2ef2-4028-aa8f-9cd66097ba13
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.southbendtribune.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
arj
os4m-d.openx.net/w/1.0/ Frame 3595
174 B
425 B
XHR
General
Full URL
https://os4m-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=ec7f2059-62e8-4446-acba-1038860d73f5&nocache=1613842805351&aus=728x90&divIds=SHZ_SBT_728x90_BTF__86&auid=540529560&aumfs=300
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
6902020d783174b4f8389e2eac539a441348f368971da0fd7cadd64bece2b7d4

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
server
OXGW/16.202.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.southbendtribune.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
mvo
tag.1rx.io/rmp/74190/0/ Frame 3595
0
281 B
XHR
General
Full URL
https://tag.1rx.io/rmp/74190/0/mvo?z=1r&hbv=4.7,2.1
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.19.147.210 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.southbendtribune.com
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:05 GMT
Cache-Control
private, max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Server
Tengine
Connection
keep-alive
auction
x.yieldlift.com/ Frame 3595
2 KB
918 B
XHR
General
Full URL
https://x.yieldlift.com/auction
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
8fa099e7fad882aba1d1b90f0b9e47a683dbe6fa19560fc38f621729f6979284

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
content-encoding
gzip
Content-Type
application/json;charset=utf-8
access-control-allow-origin
https://www.southbendtribune.com
Accept
application/json
Cache-Control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
573
Expires
0
cygnus
htlb.casalemedia.com/ Frame 3595
25 B
693 B
XHR
General
Full URL
https://htlb.casalemedia.com/cygnus?s=303653&v=7.2&r=%7B%22id%22%3A%22136c3bcc15b316c%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22144668b9914aca2%22%2C%22ext%22%3A%7B%22siteID%22%3A%22303653%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A0%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%7D&ac=j&sd=1
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-181.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2416db86422d247adfa77efe0c6ecfb95b637707044bac095b9bb53c86fbe043

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-ak-initial-geo
CC:[CH], RC:[ZH], CN:[EU], CIP:[195.242.213.99], XFF:[]
server
Apache
vary
Is-Traffic-Invalid,Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
access-control-allow-origin
https://www.southbendtribune.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-type
application/json
content-length
45
x-ak-client-geo
12
expires
Sat, 20 Feb 2021 17:40:05 GMT
pubads_impl_2021021101.js
securepubads.g.doubleclick.net/gpt/ Frame 895A
289 KB
101 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
sffe /
Resource Hash
a533e6ac10f159c258a7737b2a63378e910622fcc61e6c90be14d6d95328fb64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Feb 2021 09:38:54 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
103545
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
pubads_impl_2021021101.js
securepubads.g.doubleclick.net/gpt/ Frame 5A08
289 KB
101 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
sffe /
Resource Hash
a533e6ac10f159c258a7737b2a63378e910622fcc61e6c90be14d6d95328fb64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Feb 2021 09:38:54 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
103545
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
bid
ap.lijit.com/rtb/ Frame 895A
24 B
641 B
XHR
General
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.7.0
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx /
Resource Hash
ceca9943857f461cb27f5ba62119d4bba42ad7dec2d04d0cd7ae945df5ef182b

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sat, 20 Feb 2021 17:40:05 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://www.southbendtribune.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap1ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
hb
ssc.33across.com/api/v1/ Frame 895A
65 B
637 B
XHR
General
Full URL
https://ssc.33across.com/api/v1/hb?guid=brwk0O19ir6ikUaKlId8sQ
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.4.152.106 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-152-106.compute-1.amazonaws.com
Software
/ 33Across
Resource Hash
6de3d7d996346abb1165d465d94cea880358285fe90decf52d020a24bf75a986

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-credentials
true
mvo
tag.1rx.io/rmp/74190/0/ Frame 895A
0
281 B
XHR
General
Full URL
https://tag.1rx.io/rmp/74190/0/mvo?z=1r&hbv=4.7,2.1
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.19.147.210 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.southbendtribune.com
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:05 GMT
Cache-Control
private, max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Server
Tengine
Connection
keep-alive
cygnus
htlb.casalemedia.com/ Frame 895A
24 B
691 B
XHR
General
Full URL
https://htlb.casalemedia.com/cygnus?s=303656&v=7.2&r=%7B%22id%22%3A%227f03d40ae42f55%22%2C%22imp%22%3A%5B%7B%22id%22%3A%228b5f35c1a49104%22%2C%22ext%22%3A%7B%22siteID%22%3A%22303656%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A0%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%7D&ac=j&sd=1
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-181.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b05a333852694029e02bb3f8a195b4eb6dffeed831fd2468d3e6c11f5a421407

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-ak-initial-geo
CC:[CH], RC:[ZH], CN:[EU], CIP:[195.242.213.99], XFF:[]
server
Apache
vary
Is-Traffic-Invalid,Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
access-control-allow-origin
https://www.southbendtribune.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-type
application/json
content-length
44
x-ak-client-geo
12
expires
Sat, 20 Feb 2021 17:40:05 GMT
arj
os4m-d.openx.net/w/1.0/ Frame 895A
174 B
358 B
XHR
General
Full URL
https://os4m-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=be3a46ba-638a-4e21-b934-5f560be99c63&nocache=1613842805393&aus=300x600&divIds=SHZ_SBT_300x600_BTF__86&auid=540529559&aumfs=300
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
fc4025d062170e1dcd7eddd74780c16516ef22dcb32ab0dabc98b39d6bc971de

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
server
OXGW/16.202.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.southbendtribune.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
v1
btlr.sharethrough.com/WYu2BXv1/ Frame 895A
0
120 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=H7j8B7CTGPp1u47GG2shRkg2&bidId=12625dea0e149e&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=4.7.0&strVersion=3.2.1&secure=true
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.198.115.155 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.southbendtribune.com
date
Sat, 20 Feb 2021 17:40:05 GMT
access-control-allow-credentials
true
vary
Origin
prebid
ib.adnxs.com/ut/v3/ Frame 895A
19 B
722 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:05 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.121:80
AN-X-Request-Uuid
d56bccc2-e3eb-499d-b017-b734f63cb03a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.southbendtribune.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
hb
ssc.33across.com/api/v1/ Frame 5A08
64 B
636 B
XHR
General
Full URL
https://ssc.33across.com/api/v1/hb?guid=bFNDkc19ir6ikyaKkGJozW
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.4.152.106 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-152-106.compute-1.amazonaws.com
Software
/ 33Across
Resource Hash
1140250a8cba9bc945f55438314cb094817f9fd8c80a0d37c7f3acd50335cd0b

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-credentials
true
cygnus
htlb.casalemedia.com/ Frame 5A08
24 B
692 B
XHR
General
Full URL
https://htlb.casalemedia.com/cygnus?s=303653&v=7.2&r=%7B%22id%22%3A%2233aed512c07b6e%22%2C%22imp%22%3A%5B%7B%22id%22%3A%224ed860a38f8aac%22%2C%22ext%22%3A%7B%22siteID%22%3A%22303653%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A0%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%7D&ac=j&sd=1
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-181.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
61073828987811f51966afee5bba4346e912c3be9363e56ded7b003174dcf8ba

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-ak-initial-geo
CC:[CH], RC:[ZH], CN:[EU], CIP:[195.242.213.99], XFF:[]
server
Apache
vary
Is-Traffic-Invalid,Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
access-control-allow-origin
https://www.southbendtribune.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-type
application/json
content-length
44
x-ak-client-geo
12
expires
Sat, 20 Feb 2021 17:40:05 GMT
bid
ap.lijit.com/rtb/ Frame 5A08
24 B
641 B
XHR
General
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.7.0
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx /
Resource Hash
c00f7beae6e8e2b86a5eee72aa751ad68dac22523e4f4970f428c6865242dace

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sat, 20 Feb 2021 17:40:05 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://www.southbendtribune.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap1ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
mvo
tag.1rx.io/rmp/74190/0/ Frame 5A08
0
281 B
XHR
General
Full URL
https://tag.1rx.io/rmp/74190/0/mvo?z=1r&hbv=4.7,2.1
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.19.147.210 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.southbendtribune.com
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:05 GMT
Cache-Control
private, max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Server
Tengine
Connection
keep-alive
prebid
ib.adnxs.com/ut/v3/ Frame 5A08
19 B
721 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:05 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.37:80
AN-X-Request-Uuid
12e38188-c07a-4b03-ad5a-771a14ecc7bc
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.southbendtribune.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
arj
os4m-d.openx.net/w/1.0/ Frame 5A08
174 B
358 B
XHR
General
Full URL
https://os4m-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=359f0665-d0d6-4971-9b49-a7f477d294a4&nocache=1613842805411&aus=728x90&divIds=SHZ_SBT_728x90_BTF__86&auid=540529560&aumfs=300
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
f14446348a58ad5e1fed1679e5a35087773bbee64cc3a15f6a0bddcd4f330770

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
server
OXGW/16.202.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.southbendtribune.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
auction
x.yieldlift.com/ Frame 5A08
2 KB
919 B
XHR
General
Full URL
https://x.yieldlift.com/auction
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/rs-static/prebid4.7.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
89d8b3dc14a167839ceafebe6d54e157b7b9580c62b08b12b684209480939eef

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
content-encoding
gzip
Content-Type
application/json;charset=utf-8
access-control-allow-origin
https://www.southbendtribune.com
Accept
application/json
Cache-Control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
574
Expires
0
activeview
pagead2.googlesyndication.com/pcs/ Frame FBE5
42 B
725 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv3HJqreZLkIbWuBhtw0mch5uoUF6u0o42Ij5HvZtJlKjJsTasTVoe_5RVmipwFdP-B6sAoTEMuNmcm9aqauLKBZiBTBPP6y17-huPCs8k&sig=Cg0ArKJSzIrdiTHeXgFMEAE&id=osdim&mcvt=1001&p=484,1040,734,1340&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20210217&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=1467293519&rs=4&met=ie&la=0&cr=0&osd=0&vs=4&r=v&uup=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
integrator.js
adservice.google.de/adsid/ Frame 895A
109 B
169 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.southbendtribune.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 895A
109 B
169 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.southbendtribune.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame 895A
54 KB
12 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=29666626645391&correlator=1110164503463070&output=ldjh&impl=fifs&eid=21068773%2C21068891%2C21068030%2C31060123&vrg=2021021101&ptt=17&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20210220&iu_parts=289026909%2CYieldLift%2CHB_DEFAULT_ADUNIT&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x600&prev_scp=hb_name%3DSHZ_SBT_300x600_BTF__86%26passback_pb%3D0.30%26hb_factor%3D1.5%26rscust%3Dpool1&eri=1&cookie=ID%3D824d9cf20879a17a-224b02138cba00f4%3AT%3D1613842804%3AS%3DALNI_MbI6ziqLNP7Pugo6tpQ_ioy9GCYbA&cdm=www.southbendtribune.com&bc=31&abxe=1&lmt=1613842805&dt=1613842805716&dlt=1613842805211&idt=234&ea=0&frm=23&biw=1600&bih=1200&isw=300&ish=600&oid=3&adxs=1040&adys=2011&adks=1000909099&ucis=8okm4jxu7jyj&ifi=1&ifk=282791655&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=2&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&top=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x600&msz=300x600&ga_vid=582025434.1613842806&ga_sid=1613842806&ga_hid=751260809&fws=256&ohw=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
61e7ba658627df0663ea61fb8c5448caeea364be823a14e50f7152fc1854880f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12330
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
aa8bde3daec928214ee0de2ce0048e90.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 895A
0
0
Other
General
Full URL
https://aa8bde3daec928214ee0de2ce0048e90.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 895A
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

602c6c04bc0a6.image.jpg
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/assets/v3/editorial/2/e5/2e543646-70bc-11eb-a037-53e457579e05/
4 KB
5 KB
Image
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/assets/v3/editorial/2/e5/2e543646-70bc-11eb-a037-53e457579e05/602c6c04bc0a6.image.jpg?crop=1048%2C1048%2C465%2C0&resize=100%2C100&order=crop%2Cresize
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
750b5102a5e597808ee5921f5bd206a4c64fd3e94f0400564c338e629428e634
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
cf-cache-status
HIT
last-modified
Wed, 17 Feb 2021 01:06:13 GMT
strict-transport-security
max-age=604800
content-length
4498
cf-request-id
0862200c9700002373889ba000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
"a9ff16953163d7d96d1e461db29bc7fe"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Thu, 17 Feb 2022 01:17:47 GMT
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
624a02c0ec6a2373-ZRH
cf-bgj
h2pri
integrator.js
adservice.google.de/adsid/ Frame 3595
109 B
781 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.southbendtribune.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 3595
109 B
127 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.southbendtribune.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame 3595
51 KB
12 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=719381038066616&correlator=3481111895435120&output=ldjh&impl=fifs&eid=21068773%2C21068891%2C21069918%2C21066612&vrg=2021021101&ptt=17&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20210220&iu_parts=289026909%2CYieldLift%2CHB_DEFAULT_ADUNIT&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90&prev_scp=hb_name%3DSHZ_SBT_728x90_BTF__86%26passback_pb%3D0.30%26hb_factor%3D1.5%26rscust%3Dpool1&eri=1&cookie=ID%3D824d9cf20879a17a-224b02138cba00f4%3AT%3D1613842804%3AS%3DALNI_MbI6ziqLNP7Pugo6tpQ_ioy9GCYbA&cdm=www.southbendtribune.com&bc=31&abxe=1&lmt=1613842805&dt=1613842805933&dlt=1613842805158&idt=264&ea=0&frm=23&biw=1600&bih=1200&isw=728&ish=90&oid=3&adxs=436&adys=136&adks=2405988686&ucis=z20vj0hr40mz&ifi=1&ifk=2669993689&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=2&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&top=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&ga_vid=1350376046.1613842806&ga_sid=1613842806&ga_hid=1014698176&fws=256&ohw=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
a44fbe0106cd7084f57a8fe5bc47c2d963a2b3d6af30b4af9b050aee19d02025
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11929
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
454e894052a987406f58c9202386c9c1.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 3595
0
0
Other
General
Full URL
https://454e894052a987406f58c9202386c9c1.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 3595
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

integrator.js
adservice.google.de/adsid/ Frame 5A08
109 B
127 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.southbendtribune.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 5A08
109 B
127 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.southbendtribune.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
sodar
pagead2.googlesyndication.com/getconfig/ Frame 5A08
8 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021021101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3b897fd6e5af85ce6c3463d00b84b49056280b7e41375e7d132c5476e8d4a8e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6400
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame 5A08
5 KB
3 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=548460366341425&correlator=425148776750842&output=ldjh&impl=fifs&eid=21068602%2C21068773%2C21068891%2C31060170%2C31060011%2C31060013%2C44734255&vrg=2021021101&ptt=17&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20210220&iu_parts=289026909%2CYieldLift%2CHB_DEFAULT_ADUNIT&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90&prev_scp=hb_name%3DSHZ_SBT_728x90_BTF__86%26passback_pb%3D0.30%26hb_factor%3D1.5%26rscust%3Dpool1&eri=1&cookie=ID%3D824d9cf20879a17a-224b02138cba00f4%3AT%3D1613842804%3AS%3DALNI_MbI6ziqLNP7Pugo6tpQ_ioy9GCYbA&cdm=www.southbendtribune.com&bc=31&abxe=1&lmt=1613842805&dt=1613842805945&dlt=1613842805252&idt=206&ea=0&frm=23&biw=1600&bih=1200&isw=728&ish=90&oid=2&adxs=436&adys=2784&adks=2405988686&ucis=o7z4yiv7qfed&ifi=1&ifk=2669993689&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=2&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&top=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&ga_vid=644337742.1613842806&ga_sid=1613842806&ga_hid=917714855&fws=256&ohw=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
504e827f6fee802e5eeb50d33b085554be09b78cf65e017491df06d84f7f7a75
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2843
x-xss-protection
0
google-lineitem-id
4756980902
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138245954259
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
c4981dc7ca65972f929725d0e6576531.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 5A08
0
0
Other
General
Full URL
https://c4981dc7ca65972f929725d0e6576531.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 5A08
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

sodar2.js
tpc.googlesyndication.com/sodar/ Frame 5A08
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1611170586013198"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6403
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:05 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 79A5
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/221/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
4984
date
Sat, 20 Feb 2021 16:57:53 GMT
expires
Sun, 20 Feb 2022 16:57:53 GMT
last-modified
Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
2532
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
pagead2.googlesyndication.com/bg/ Frame 79A5
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fb73d5d93057e64e297129d2873fdd0fb83ea5dea63bf77cd87e9041af59dbc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 07:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 09 Feb 2021 09:15:00 GMT
server
sffe
age
207966
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6187
x-xss-protection
0
expires
Fri, 18 Feb 2022 07:54:00 GMT
5dce83fef22e2.image.jpg
bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/assets/v3/editorial/5/b8/5b80c6c4-0796-11ea-b4f7-530c105ed375/
2 KB
3 KB
Image
General
Full URL
https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/content/tncms/assets/v3/editorial/5/b8/5b80c6c4-0796-11ea-b4f7-530c105ed375/5dce83fef22e2.image.jpg?crop=1287%2C1287%2C161%2C0&resize=100%2C100&order=crop%2Cresize
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.130.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c2670ce253c1d2e8b774fe6f6f95725ad85344a1adb2efdbc6f3873b3d17c49
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
cf-cache-status
HIT
last-modified
Fri, 15 Nov 2019 10:54:55 GMT
strict-transport-security
max-age=604800
content-length
2438
cf-request-id
0862200d2b0000237368bec000000001
x-robots-tag
noarchive
x-vcache
MISS
server
cloudflare
etag
"b4f802d2d6c258cc86a730921468d510"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Sat, 12 Feb 2022 11:11:18 GMT
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
624a02c1df082373-ZRH
cf-bgj
h2pri
gen_204
pagead2.googlesyndication.com/pagead/ Frame 5A08
0
46 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021021101&jk=548460366341425&bg=!sbKlsvHNAAXRs2QT0TsAKQB2-DxanL4BiJCCO905pA4-pVZGmZzCh3NZStRB0kTtPP61jrEVORHxAgAAAGRSAAAAE2gBBwoAdjnngmR-3pGynlyX7D12NQw7wI7lDgKc8JX19yTpE6HG99LgV3HRsm7TyNYU-92hD_KwUCBaP0EmnPnW9Q4-Y8kJGmM62JvF-rljWDkKbKpr9vvXQjeEulAyC-L3_bZNJ7AoAwbznowqFU5R3rMqj2mIH4p1fmyZAiCbsl7Z3RTAjp36lq0c3j2_4vwtJWjQ6J7jagktPVzTMnZsebEgEwSx2uFXQvD2a1gQs-SGwPDe_5Bt_T5IAn21i4GDxBTtN0ZmN-wG5rm5cm01nBceKCZhCB-bi4k6HrI-3x6XdZ7OR8fIBIGjMCqggx_nuhNbgvi0YDi19UDWDbxvHEMR-XLVMHRDIM5qdCQXMf4_UU0tFTK6SWnyjoMG82VAux5UMqeP7lXnAVR5g0do3p_mKb4IvpqXIFAGPB71BuT5F3-0sklL8AIyHyWRNPlOcuHoe9h8m7va_Da5i0oKuV3ARre-n8orfUQPynLWiSrKKV2odpWJi-r8gBifqZz7FO8lUToRhd1pWDR1ey6vSqLB2wBmoH6nyqeyNojyGdPIQeonaME6RFrwR9nAHDyzXA4V2vEmz8_zU10RZcYa09HPV8Fh5nm3dwBFjN42ICGsZ1yRQ2-WT6Khf_qT128hfuFX6FZtynPdHfkUvT25JI34tWlddqd16InryaregbfZH2KsBPFBCaUk6WLGeJXFdfjDcC0_uPhR5y8HNjZv_XqvQIbez5nRrbTO3z7A-4RZw90PpUFCcLIzdukg1Ny1PzsdT76iH5S8j2l68SA6L3k7FAxY-5PZ2gNa55PQEO7JguRfAmjnAsVGSuIstb9m1-9QHRkliqs1LYC58Y_rpqUkMVyPicSI6c520z8ZUUb04NdzgnSisRzpI3g4
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 279B
42 B
89 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstruSqUaYufiAnSl61OEAG53qnVuLIfjA5Up2ro6GlIfQs1HKweAUfyz8E9nlMKlsLNwTJtZgGw5Ytk2-ur7WNSYDna4MJ7OKcuPuIN4ZM&sig=Cg0ArKJSzH7vjq6epsAcEAE&id=osdim&mcvt=1002&p=272,872,366,1600&mtos=0,1002,1002,1002,1002&tos=0,1002,0,0,0&v=20210217&bin=7&avms=nio&bs=1600,1200&mc=0.96&app=0&itpl=19&adk=3273727798&rs=4&met=mue&la=0&cr=0&osd=1&vs=4&rst=1613842804596&dlt=0&rpt=609&isd=0&msd=0&r=v&uup=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
amp4ads-v0.mjs
cdn.ampproject.org/rtv/042012040327000/ Frame 491B
186 KB
52 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
078707fe31618a1d7ed83d8ec471960cfcfce9c38717c6da3998d24adecd740d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
154588
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
53362
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 22:43:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"86dd0f5e76ee8ee4"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 22:43:38 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/042012040327000/v0/ Frame 491B
13 KB
5 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b286d85db3ea459f2c6ae5d83faddcb6870d52dffc5acab28d0fa229fea9a92a
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
222605
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4851
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 03:50:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"0ebc035bc977986c"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 03:50:01 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/042012040327000/v0/ Frame 491B
90 KB
27 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/v0/amp-analytics-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d1aa57ca9dcb025377ed43ba7e7493650315a9853e0f7cb9cff693d4055a59e6
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
154588
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27555
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 22:43:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a2730efbd100828f"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 22:43:38 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/042012040327000/v0/ Frame 491B
3 KB
1 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/v0/amp-fit-text-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3171df631846e0ba4065e4bcdf3dbdfe8271f1e044842b1af9f0116b4da78409
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
154588
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1350
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 22:43:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"d2faa7ed8a7f7eb9"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 22:43:38 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/042012040327000/v0/ Frame 491B
41 KB
13 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/v0/amp-form-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a63c2fd0ea62cdf1d313e9c71775114fcdee3fa647dc7a7c2e3f2944378d5719
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
154588
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12911
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 22:43:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"3a3cc8a5350dec94"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 22:43:38 GMT
css
fonts.googleapis.com/ Frame 491B
3 KB
653 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c312c8dcff723c5dcea1f1fc9cc0de63d9c7f29783cc9a0a4a1239c7619b5c7e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 16:22:07 GMT
server
ESF
date
Sat, 20 Feb 2021 17:40:06 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 20 Feb 2021 17:40:06 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/12191788164384279488/ Frame 491B
18 KB
18 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/12191788164384279488/downsize_200k_v1?w=400&h=209
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b9a06c2d62c73e9b8ee5272b190044182a64e7369a80b1d1fded8224a5c376bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 04:15:23 GMT
x-content-type-options
nosniff
age
221083
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18052
x-xss-protection
0
last-modified
Mon, 15 Feb 2021 17:10:03 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 04:15:23 GMT
truncated
/ Frame 491B
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0cc7088b335b30f7b1fa0903bc8aa143b11cb8408032d62d28d5ab768cc68c88

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame 491B
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bc66916ab132e6b401020dbf1a67e7057d8bf474e0fedfad0710524a446f3ed3

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 491B
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 08:22:57 GMT
x-content-type-options
nosniff
server
cafe
age
33429
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Sun, 21 Feb 2021 08:22:57 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 491B
295 B
389 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 19 Feb 2021 23:24:51 GMT
x-content-type-options
nosniff
server
cafe
age
65715
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Sat, 20 Feb 2021 23:24:51 GMT
l
www.google.com/ads/measurement/ Frame 491B
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRL23lvVNS1PA8KqR1fh7hlmCF4IAy0IynS39aYZRkBKTfzPIcWF2qrpetR1kJblbglAsNkSVkquvdtIGvb5sN9iReD_Q
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

adview
securepubads.g.doubleclick.net/pagead/ Frame 491B
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CZ-VqdUkxYNrILoCNjuwP55eAkAq435KwYY_S98OIDZaCzYWIFhABIIXhvEpg9ZXOgeAEoAGkrJzJA8gBCakCuZuyx-K3sj7gAgCoAwHIAwqqBJMDT9Bqo94nyL9Bzn-hQbAOTlAgAaANNLlw4z1Z7IjDcnqMWmjoopW2m-aD3K66zYj9wJ-4CawcHJ1PnzI2SYdSWa_lE9rY8JpbT7Li0WGc-o6TjJxXXWrFGUUYawjYK6jc81C2_60oAbfVVVYrg4od94lgnSCZVLCeOl9YrTT-Y3fkIDaA4LaZgTrPVp71dtnGBPoe0OiCYkWRtNZNj0g74wibxM_-MyCS95vqqRz3giyvmU_zw3s580QeghzKX9qQ9eW2A7_ibIC60GQ9Q6yb-pgKFOeyUSCpVC2vVNZO-XiXXvxrMOaspaaWauL_IxNnJ4FIykIXSIA95TIrHAelH1iyzx6Lf7v4HB2wF25O8J7shgQ4eJ3eTm4TwDckDMeLnOwWCfW64VAA-hkHJLantadFVuFEBeGGKBapwR5O9SZ3LISP78OwsSLsNTlHQfRAo8_GMJdMZ0pvaqXxak0rVSoNNrhLGhlA8qcQxLP7sqS7ZEzQ6jUTTbwsp5kpZ-iDEDs2i4_3yLY2wevW80phMitEI8AEmMqYz6IC4AQBkgUECAQYAZIFBAgFGASgBi6AB8TT4zaoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQluYK0ggHCIBhEAEYHfIIG2FkeC1zdWJzeW4tODU1NDMxNjA2NTk1Mzc3NIAKA8gLAdgTDbIXGgoYCAASFHB1Yi03MTY1MTYwNDU4OTYyNjEx&sigh=hrkq7wH2xwA&template_id=5000&tpd=AGWhJmuy3nwBg41UqFmzvjI_VgDr5XMrdjCsB2IUfyEsALKHTg
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

sodar
pagead2.googlesyndication.com/getconfig/ Frame 895A
8 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021021101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d765650b71b36476c850d4e745dbc6bc55bb8b3964707277147c33e26d42aef7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6375
x-xss-protection
0
4UabrENHsxJlGDuGo1OIlLU94YtzCwZsPF4o.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 491B
14 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwZsPF4o.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1daab0f66666bc3a1d05d70de979a80680d985cc924e233fab61eef2d03bafe2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 05:19:54 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Nov 2020 20:26:17 GMT
server
sffe
age
217212
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14816
x-xss-protection
0
expires
Fri, 18 Feb 2022 05:19:54 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp5eKQtG.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 491B
14 KB
14 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp5eKQtG.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f199a20f1fee7dec152b3591272f9715b536ed88b4c36194488fd5a734caf707
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 12:56:41 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Nov 2020 20:26:06 GMT
server
sffe
age
189805
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14608
x-xss-protection
0
expires
Fri, 18 Feb 2022 12:56:41 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 895A
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1611170586013198"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6403
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:06 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 0240
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/221/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
4984
date
Sat, 20 Feb 2021 16:57:53 GMT
expires
Sun, 20 Feb 2022 16:57:53 GMT
last-modified
Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
2533
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
pagead2.googlesyndication.com/bg/ Frame 0240
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fb73d5d93057e64e297129d2873fdd0fb83ea5dea63bf77cd87e9041af59dbc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 07:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 09 Feb 2021 09:15:00 GMT
server
sffe
age
207966
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6187
x-xss-protection
0
expires
Fri, 18 Feb 2022 07:54:00 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 491B
2 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 08:22:57 GMT
x-content-type-options
nosniff
server
cafe
age
33429
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Sun, 21 Feb 2021 08:22:57 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 491B
295 B
320 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 19 Feb 2021 23:24:51 GMT
x-content-type-options
nosniff
server
cafe
age
65715
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Sat, 20 Feb 2021 23:24:51 GMT
amp4ads-v0.mjs
cdn.ampproject.org/rtv/042012040327000/ Frame 3031
186 KB
52 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
078707fe31618a1d7ed83d8ec471960cfcfce9c38717c6da3998d24adecd740d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
154588
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
53362
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 22:43:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"86dd0f5e76ee8ee4"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 22:43:38 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/042012040327000/v0/ Frame 3031
13 KB
5 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b286d85db3ea459f2c6ae5d83faddcb6870d52dffc5acab28d0fa229fea9a92a
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
222605
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4851
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 03:50:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"0ebc035bc977986c"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 03:50:01 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/042012040327000/v0/ Frame 3031
90 KB
28 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/v0/amp-analytics-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d1aa57ca9dcb025377ed43ba7e7493650315a9853e0f7cb9cff693d4055a59e6
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
154588
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27555
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 22:43:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a2730efbd100828f"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 22:43:38 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/042012040327000/v0/ Frame 3031
3 KB
1 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/v0/amp-fit-text-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3171df631846e0ba4065e4bcdf3dbdfe8271f1e044842b1af9f0116b4da78409
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
154588
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1350
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 22:43:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"d2faa7ed8a7f7eb9"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 22:43:38 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/042012040327000/v0/ Frame 3031
41 KB
13 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/042012040327000/v0/amp-form-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a63c2fd0ea62cdf1d313e9c71775114fcdee3fa647dc7a7c2e3f2944378d5719
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
154588
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12911
x-xss-protection
0
server
sffe
date
Thu, 18 Feb 2021 22:43:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"3a3cc8a5350dec94"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Feb 2022 22:43:38 GMT
css
fonts.googleapis.com/ Frame 3031
6 KB
701 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5018230bc803da921c5e52b4c9e13973754ca8819e302dfe47320decd606a335
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 20 Feb 2021 17:20:30 GMT
server
ESF
date
Sat, 20 Feb 2021 17:40:06 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 20 Feb 2021 17:40:06 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 3031
2 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 08:22:57 GMT
x-content-type-options
nosniff
server
cafe
age
33429
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Sun, 21 Feb 2021 08:22:57 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 3031
295 B
320 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 19 Feb 2021 23:24:51 GMT
x-content-type-options
nosniff
server
cafe
age
65715
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Sat, 20 Feb 2021 23:24:51 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/12191788164384279488/ Frame 3031
6 KB
6 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/12191788164384279488/downsize_200k_v1?w=195&h=102
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
22a4e1894d46aa4685c6affb16de0dbc266a8371cbd2ad542b7948484a92a938
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 16 Feb 2021 01:22:38 GMT
x-content-type-options
nosniff
age
404248
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5808
x-xss-protection
0
last-modified
Mon, 15 Feb 2021 17:10:03 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Feb 2022 01:22:38 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/652503062678389469/ Frame 3031
2 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/652503062678389469/downsize_200k_v1?w=100&h=100
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8bff9ec3a2c218db516f668f50f0b70958136d28892dc840bc0544a20ef7d61b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 15 Feb 2021 13:35:34 GMT
x-content-type-options
nosniff
age
446672
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1911
x-xss-protection
0
last-modified
Wed, 13 Mar 2019 08:45:00 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 15 Feb 2022 13:35:34 GMT
truncated
/ Frame 3031
221 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame 3031
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cb1dee846a3020eb050cf43ff25a9a468352cd2c81998a9ff585a5bfd6fc4d9e

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
adview
securepubads.g.doubleclick.net/pagead/ Frame 3031
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C8h93dUkxYNL2O4vRgAeKzquYB7jfkrBhj9L3w4gNloLNhYgWEAEgheG8SmD1lc6B4ASgAaSsnMkDyAEJqQK5m7LH4reyPuACAKgDAcgDCqoEkgNP0CcQ9zFJgE2LLxtXtF1fFBCsDfBigIML-7dIR9tQInOtqZZxK1QTTRmcreRza9y7a6L3uw8wYjRp3Y81iR3qYKErEnkvH78mFZySBAI-e1G-l4dxZ2Frcxtdw6_wL_orrDJQGot3Y4eWlfuPcJpNxvkcUL3Rq6iEeN8hOd6ZCtEncj4rBPDnIvbLSn1NK6ddAsERTaE0O0mLqR7uMGg1Fw0EPzSiQFQIzB5kVjX6UMHngjC5DNa49WuiTEO0gff0-ueAHhbsa7TRyi68qkM7up-HWbinKJtUpriGICwCf2y4JrsQan1bf-EYcsXHAB2_I73c3GPYUIFEig1kxkuFGBETXb0HzHuILO9pmZaOHaUPz7EnbfPUXZFOHEA-oKKMGZ92ilckmHkauXH3bXW-fZrn_713CIuW4YJxVdQwrerfk-UslD7pugQEwJw1et0CF6x1MqcgrF8wDcO4tPJ_6vGahD-H2hXzA9l-0Um8Th5aXj_-YshVEXJPUnVnRbKFVWiaY6IeyTs0Ouo2nfR7md3ABJjKmM-iAuAEAZIFBAgEGAGSBQQIBRgEoAYugAfE0-M2qAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEPOZCtIIBwiAYRABGB3yCBthZHgtc3Vic3luLTg1NTQzMTYwNjU5NTM3NzSACgPICwHYEw2yFxoKGAgAEhRwdWItNzE2NTE2MDQ1ODk2MjYxMQ&sigh=X6XXXvcDXUM&template_id=484&tpd=AGWhJmv3MPErYwwTlrjogAOOZ4oT2LsV-kGhAPeSx5UgypUxww
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

sodar
pagead2.googlesyndication.com/getconfig/ Frame 3595
8 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021021101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5148b0b5c615002df64486de2b79e03fff1b34d9e9833fd30074cd42980f0442
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6435
x-xss-protection
0
pw.js
d3oi8laqsvc6ey.cloudfront.net/ Frame 5C26
83 KB
27 KB
Script
General
Full URL
https://d3oi8laqsvc6ey.cloudfront.net/pw.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:600:5:ee0e:9e80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
85a39b2febc8f8dc2a7ee1e3c4e8a23bcbe10f8250614d32efdd4b4d4bd40df8

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 00:33:00 GMT
content-encoding
gzip
last-modified
Thu, 19 Mar 2020 14:03:51 GMT
server
AmazonS3
age
61627
etag
W/"d0854b8502ea96f99f33cad6229947a4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 0d5d2d408eb42296c7636196e25ef8a3.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
x-amz-cf-id
ORG_Kr54H9utYGRybao9GBYbcZssL5nH3HhSV4ux8t7m31-1xJlnmQ==
view
securepubads.g.doubleclick.net/pcs/ Frame 5C26
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsudeL1-0ZeR57M7ssqQajnUdaUQSsIw9Yo_aS1_6Hy6I_iBKHLl1U1MdzRwBffOsIOjDQioQbQi9agMan8XlRSUqDHgnqYbqa5JqB3bJVzR4VwTXomFZZ-u1t04XF6SRv5n0ygfA3hwDn3ryrNlkSlQem9ElGzJbZI_Zgp3xn6BRzzx-1Mo-azwz7TvMkYHhlsFgbq7bBKoH2Dbd1rB6xvhZXRrdNqm5hv1yDRsG6xRldKA5vQSeFzaPtgVNZ7MbdGyB524I-8RzEGrb8lONv0uAvgQv3A29PhBYX2KZ8CLKLsA-roMQdWiksddV1GQXBrpwtz_3eiZsXY-G8ze62l9lVW_etuMbw&sig=Cg0ArKJSzAiD1T9U8vV7EAE&urlfix=1&adurl=
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:06 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
136953cb-88f9-48b3-9417-8f28d8a3cf54.js
d2na2p72vtqyok.cloudfront.net/client-embed/ Frame 5C26
5 KB
2 KB
Script
General
Full URL
https://d2na2p72vtqyok.cloudfront.net/client-embed/136953cb-88f9-48b3-9417-8f28d8a3cf54.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.91.133 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5f8074a11d8d589151ee508aeb0245cc63374ab3c7a354462fb4143e5dd007bc

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 04:01:42 GMT
Content-Encoding
gzip
Age
49105
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Sat, 20 Feb 2021 04:00:38 GMT
Server
AmazonS3
ETag
W/"66c73432901a29ee2205b99cd976dc09"
Vary
Accept-Encoding
x-amz-version-id
JOhKuQ0zU9OBIJQmEfH0uTYmd11HW.Cn
Via
1.1 1d04caaed0a43993076e404ebf3738da.cloudfront.net (CloudFront)
Cache-Control
max-age=60
X-Amz-Cf-Pop
PRG50-C1
Content-Type
application/javascript
X-Amz-Cf-Id
e7jVSHmb2394xCZe9U8IHPGiZQ26VwpStmp93153yyPFiRl5m9tjmg==
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 5C26
107 KB
33 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae35469a2de645d561d555105d21f075e0469c83a7bd02ebc9547d4d5b616f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1613565156040306"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33368
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:06 GMT
osd.js
www.googletagservices.com/activeview/js/current/ Frame 5A08
74 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1143bb5ae891056f59482184346b0fe47d8e95c9e0f159f023bf0f95ec45222d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1613565174175677"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28346
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:06 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 3031
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 09:18:12 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
202914
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11020
x-xss-protection
0
expires
Fri, 18 Feb 2022 09:18:12 GMT
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 3031
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.southbendtribune.com
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 17 Feb 2021 08:43:20 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:52 GMT
server
sffe
age
291406
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11180
x-xss-protection
0
expires
Thu, 17 Feb 2022 08:43:20 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 3595
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1611170586013198"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6403
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:06 GMT
truncated
/ Frame 5C26
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f61e5cd4ff71adff6250385f2915904e1e0401bb40af334eb03a1e5adaea0456

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
21bc8503-7806-41da-b650-37b6eedc566f.js
d2s8wlbatk24s7.cloudfront.net/service/js/ Frame 5C26
50 KB
17 KB
XHR
General
Full URL
https://d2s8wlbatk24s7.cloudfront.net/service/js/21bc8503-7806-41da-b650-37b6eedc566f.js
Requested by
Host: d3oi8laqsvc6ey.cloudfront.net
URL: https://d3oi8laqsvc6ey.cloudfront.net/pw.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:2600:d:77c3:2dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
8f37f7a6e8844b8e059ff5d8525c22db03649fcba4db679f0122a9044b29a9b5

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 16:04:56 GMT
content-encoding
gzip
server
nginx/1.10.3 (Ubuntu)
age
5710
vary
Accept-Encoding
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
14400
cache-control
public, max-age=14400
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA56-C2
access-control-allow-headers
*
x-amz-cf-id
e0KQPg8PdbworIRY9hnPy2kIUDML7lMRC6sRGGh20zYd01yhOm-Vfw==
via
1.1 27f780feafa4114cfc67d86fca85d124.cloudfront.net (CloudFront)
/
includemodal.com/service/imp/21bc8503-7806-41da-b650-37b6eedc566f/ Frame 5C26
42 B
132 B
Image
General
Full URL
https://includemodal.com/service/imp/21bc8503-7806-41da-b650-37b6eedc566f/?rand=2710411&referer=https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.148.110 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
server
nginx/1.10.3 (Ubuntu)
content-length
42
content-type
image/gif
runner.html
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 3FFB
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/221/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
4984
date
Sat, 20 Feb 2021 16:57:53 GMT
expires
Sun, 20 Feb 2022 16:57:53 GMT
last-modified
Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
2533
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
gen_204
pagead2.googlesyndication.com/pagead/ Frame 895A
0
23 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021021101&jk=29666626645391&bg=!c3ClcDPNAAXRs2QT0TsAKQB2-Dxan8LdtZK4_3Rk0iAF5Y-TsSfqdCxCk6ZgecSwIxatUR_HruYNAgAAALJSAAAAOWgBBwoAdkc68C22U6pHTqGuVZ2sNhv8-WwceSoFLg6GP0STHLlV4LVBIy8cJHBzjk3M9Dzrs9de_bSt1lJBrw0VTZOyRmZwiUUDSWqoqsmTZKGyJvD8Tye9aM9uZuiHGiioG3DWOi32drM-eXTUGlFhw3zEvJvTagnIjgOZAiBt42kX_dKDVoNoTVb-Q2yTu-NFong9H1uFsqQy6Sxc9nJ_VvSXZhAaV1VWHWVAl_OewA66qXRsPICVReiHPDwViouEuwS1_hs-4a22q7Xz0NMCR_QKbWj6__9V68IBzvLeZxWs5tGG8uKodFceXDPDX0SuElf8p32hGFAbqjkF3wMcknV8f6g5Cyyb5EBeiBB6c_2dSJ0fAVYTCfSiUXZCGDOH5n7PdG_G7n1QLzKgkgFyZ6m_pXidX6aOzQxn0ZxMw1K_IMjn2Ot2aKlqQQ_qXg0u3yoCwpLG2nHMHaUM3_HckcJkRbKhW7JNXVZLM4N7OnMUwcQx4C5naJVQEXGDiLUdL8GS12OFbMLEv5jm7AcFZIV-NjCbcp2_3UKIiSGgctSOvzP05KJ6ACVeewOSa6CqqzKhwxTYW_WgEWL4xgg-LwUcH_BPzkMduj6BxTLoH0InxFQdCZ7wXz7HbyVnI3VsHnTU8wEh-Z44-kSQY26evao-ojjM8c_x9FPHpQtkahpEwzY1OsPqui5sAI8vqs8cH0iStZ9gfYEBoJmwFRqJG0OgWinEUEuMW1BU3TEHE7oGyg82NGGWkQagJDZQ8FKgs0s5mcsI7xexQcAahQ-1lr9hH3Kqrzn9u2q2tCE0eXC-RPOXJwcb2BkhNbX7V1pIpLYL_ulFfFXQH4OAmwQNPHhVlnEoQunJywPK_ooePLFoohtfYWuxYNdEBbvE
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js
d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/ Frame 5C26
283 KB
30 KB
Script
General
Full URL
https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/136953cb-88f9-48b3-9417-8f28d8a3cf54.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:e00:1c:386f:ec80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
158e7c54ad9af075fbe586ad9dad5570e5172992c7b3e36a4f5226992a0cf4e5

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
hXhmLzYFrCxG7xyWkTSS1vyncpNEDu7q
content-encoding
gzip
last-modified
Sat, 20 Feb 2021 04:00:37 GMT
server
AmazonS3
age
26
etag
W/"098b6a8c95e8963fa64322839fbffd31"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 c1caf5d327c9eee53d26ab7b7a8235f0.cloudfront.net (CloudFront)
cache-control
max-age=60
date
Sat, 20 Feb 2021 17:39:40 GMT
x-amz-cf-pop
ZAG50-C1
x-amz-cf-id
APZceL6sIO7gxZLzYhgqjS1Tgvou4ePOwJJy-5c3QunYPRDcAWM_RA==
log.gif
includemodal.com/static/ Frame 5C26
42 B
200 B
Image
General
Full URL
https://includemodal.com/static/log.gif?logger=1&token=1613842806587&url=https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js&o=https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.148.110 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
last-modified
Thu, 26 Sep 2019 18:10:35 GMT
server
nginx/1.10.3 (Ubuntu)
accept-ranges
bytes
etag
"5d8cff1b-2a"
content-length
42
content-type
image/gif
-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
pagead2.googlesyndication.com/bg/ Frame 3FFB
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fb73d5d93057e64e297129d2873fdd0fb83ea5dea63bf77cd87e9041af59dbc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 07:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 09 Feb 2021 09:15:00 GMT
server
sffe
age
207966
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6187
x-xss-protection
0
expires
Fri, 18 Feb 2022 07:54:00 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 3031
2 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 08:22:57 GMT
x-content-type-options
nosniff
server
cafe
age
33429
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Sun, 21 Feb 2021 08:22:57 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 3031
295 B
320 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 19 Feb 2021 23:24:51 GMT
x-content-type-options
nosniff
server
cafe
age
65715
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Sat, 20 Feb 2021 23:24:51 GMT
/
geoip.insticator.com/json/ Frame 5C26
228 B
420 B
XHR
General
Full URL
https://geoip.insticator.com/json/
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.200.180.114 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
3a195f4603b4092d6c65a908039abc287fc010c794122639efc30dc3a925f103

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
https://www.southbendtribune.com
date
Sat, 20 Feb 2021 17:40:07 GMT
access-control-allow-credentials
true
x-database-date
Sat, 20 Feb 2021 04:57:03 GMT
content-length
228
vary
Origin
content-type
application/json
usertracking
b2c.insticator.com/v3/pages/ Frame F5BC
8 KB
3 KB
Document
General
Full URL
https://b2c.insticator.com/v3/pages/usertracking
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.200.180.114 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
984bca55409990098cf74adc47ed650c3d22c68900739950bd14c04c9d45f8f7

Request headers

:method
GET
:authority
b2c.insticator.com
:scheme
https
:path
/v3/pages/usertracking
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
content-type
text/html; charset=UTF-8
content-length
2821
etag
73d23cdd-62f8-4074-81cb-4e502729daa5
vary
Accept-Encoding,Origin
pragma
max-age=3600
cache-control
max-age=3600
content-encoding
gzip
instbid-3.27.1.js
df80k0z3fi8zg.cloudfront.net/files/ Frame 5C26
335 KB
104 KB
Script
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:e200:10:3422:3f00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
455be7fcec13cc2b2da508725109f873e05887cb138420220bfd3347ea83a80e

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
G.547isRt8lLN41CDbpGsEJcBujAZ4SG
content-encoding
gzip
last-modified
Fri, 30 Oct 2020 18:18:58 GMT
server
AmazonS3
age
56835
etag
W/"5d76e2ad273993d2ab567070fca7d79e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 447f0defb04b912ed949f0fdd5a6492e.cloudfront.net (CloudFront)
date
Sat, 20 Feb 2021 10:22:48 GMT
x-amz-cf-pop
ZAG50-C1
x-amz-cf-id
Rm5ixItFZKL_ZZH-h_PyRXcHmKU3g8WqKdwbU7tVQJJTbfrcGsvZsg==
config.js
confiant-integrations.global.ssl.fastly.net/Fseez_-nDyWQXIJsbnoKkKTHXC4/gpt_and_prebid/ Frame 5C26
76 KB
19 KB
Script
General
Full URL
https://confiant-integrations.global.ssl.fastly.net/Fseez_-nDyWQXIJsbnoKkKTHXC4/gpt_and_prebid/config.js
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e642c0ca1e51184fce51d97e3dbccb9a9fa3c07b989a0f5a6265d3055c1cffbc

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:06 GMT
Content-Encoding
gzip
Age
1605
X-Cache
HIT
Connection
keep-alive
Content-Length
18391
x-amz-id-2
uJu9YAMNs/67aPoizJiek2coclzm+hjLCp5KuW6W9RAljEPUq/ySzgwa8xzJbf1edNat5u1FdaQ=
X-Served-By
cache-hhn4054-HHN
Last-Modified
Sat, 20 Feb 2021 16:42:02 GMT
Server
AmazonS3
X-Timer
S1613842807.914438,VS0,VE0
ETag
"b112ee1926c69a1df13a0e343c33efc5"
x-amz-request-id
E1B24F518A22653B
Via
1.1 varnish
Cache-Control
public, max-age=900, stale-while-revalidate=3600
Accept-Ranges
bytes
Content-Type
text/javascript
X-Cache-Hits
95
apstag.js
c.amazon-adsystem.com/aax2/ Frame 5C26
115 KB
30 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.24.128 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
130eab0b79272570e565d77bb286b5755b9aae8f33efe8af7a2689bf8eabb859

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
pkiOsnrw5ub40d2SPOSAjPBBoA7O4uIM
content-encoding
gzip
server
Server
age
401
etag
d7c8ebbead57940cf77ae4183f7ff01a
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 384bf15c1ac91d451725d766417680b1.cloudfront.net (CloudFront)
cache-control
public, max-age=900
date
Sat, 20 Feb 2021 17:33:25 GMT
x-amz-cf-pop
ZAG50-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
2ZprDRoYjUgJtt8ZyogThZXjev-ydwDU6i935Q1oPXs3XUWU76m1BA==
log.gif
includemodal.com/static/ Frame 5C26
42 B
199 B
Image
General
Full URL
https://includemodal.com/static/log.gif?logger=1&token=1613842806587&url=https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js&o=https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.148.110 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
last-modified
Thu, 26 Sep 2019 18:10:35 GMT
server
nginx/1.10.3 (Ubuntu)
accept-ranges
bytes
etag
"5d8cff1b-2a"
content-length
42
content-type
image/gif
log.gif
includemodal.com/static/ Frame 5C26
42 B
199 B
Image
General
Full URL
https://includemodal.com/static/log.gif?logger=1&token=1613842806587&url=https://confiant-integrations.global.ssl.fastly.net/Fseez_-nDyWQXIJsbnoKkKTHXC4/gpt_and_prebid/config.js&o=https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.148.110 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
last-modified
Thu, 26 Sep 2019 18:10:35 GMT
server
nginx/1.10.3 (Ubuntu)
accept-ranges
bytes
etag
"5d8cff1b-2a"
content-length
42
content-type
image/gif
log.gif
includemodal.com/static/ Frame 5C26
42 B
199 B
Image
General
Full URL
https://includemodal.com/static/log.gif?logger=1&token=1613842806587&url=https://c.amazon-adsystem.com/aax2/apstag.js&o=https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.148.110 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:06 GMT
last-modified
Thu, 26 Sep 2019 18:10:35 GMT
server
nginx/1.10.3 (Ubuntu)
accept-ranges
bytes
etag
"5d8cff1b-2a"
content-length
42
content-type
image/gif
gen_204
pagead2.googlesyndication.com/pagead/ Frame 3595
0
23 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021021101&jk=719381038066616&bg=!sbKlsvHNAAXRs2QT0TsAKQB2-DxaWlWRBhvClRwU8J1TnjV8l5KYlIxA3p6UDrCwJzp1Pj9L86wfAgAAAHBSAAAADWgBBwoBe-BmRirjw4q7g3Vw6CLyTOzXI_OYzG2qTxg9MyvZDwgnl5-LgaO7LIDMrrmvjC-TqkW_9PhpO8PEQJDcJ7GqmWQFcTNrqmgtrjVVEiC4Om4asn07UHmvOpe_Y8ip7k8wwtcQZYDT25srda-FHgZM6X1WhDymZ6EyTb3EbqS5fA8b9ZCdvvcgvpss4AHzGczXGI4951Xm7bgy6tSOBjCSAKVNA_wLfciOuVY71bvf4sF7tN71_OsFWfG5d5XE85FbKsEYvWQELs0CxeZId2NLp00avflw0PCZ5LXwX9MNgHkDA4qwnBouhZoxKEI4x6ABY-jDWdYOurVIBTsKOJMNwii4qDaeTCqbEkul4wtuvviKbVCa0sHD0uY4nsKLBxzQQ9vjeaC1A6aK2psB3-9nd8t-qzrsIVzLcU2XKOVgrYcE8WxagiQNVmfoOCH77VAgy6eFCoywe0_qnOUitxvgqtq0lfkoJVlPmF7e6PsoFsdfYdHHIvHzXY6mXi2ZAiDCQe49urhcKS-7K-pon9oO1OQXDqDNkpDbRJWaFz1A2lzm_oVsn8laqYfq11Rotz_Wvy9mn12v-DxOpfaaouYfKR-ps9dN_GLJTQnj_zG2giz5SZndKWnNuMi1Pm0jyNWuWM1cdfgFtUnsQYxaUtvtkdap-Tel_LbOU9jLGh-yyKykFHTFp2JQEgUH0qmwx0nbqhaiFJI7NrAXhxhQV3CNX3NLzbacHc8NFWx0YpXX2I-_x5zryKdpS0cWtOv5VRVY6BRIVJ6SfLxkgRSfcv37_NLm8-JyfEvvfvj1p3cDiR7mkjps-W4ZpQhMVGFL3vycWQfPyfWYU_a2jIGURn36POTgCdxd-oqUpHTcs3xdndMRcckBphBTtUSOiwD3zLtdc0vS5SJv1cedx9Z_OHTTjS4cRnU4S6ST8ceQVxLtw5iXoccF3zwxkMeQ4KFdHosASsv399Q0QS1QxA8CmcbLFyqA0GC4msbnOfskg60jXokASmDjvKFE06kDMUYEsPPMz0z-Ul9AUk4ENbZJRjqUOTKf4ylPfVyatp6BHB5P7caf6EDIN8C46n0jmbieFytlievXnw6nMEES4sctOZF4GP-PIn1mzRXlTiFZvrdkwSFjoB2CIn59PqtiO4s46Q6bJGsLQ7D9AQJIkVR85ut-9UdmlFr_IZnEgXHaHLgochPOPT6-ZiwH1uIad0SRpwhsYC593aFnECyIzcU_wR9w
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 5C26
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.24.128 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
8kbPIzTLk7_TMvnggUSDACBTugDfX2qC
content-encoding
gzip
etag
W/"a4d296427fc806b21335359e398c025c"
age
36577
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Fri, 29 Jan 2021 06:42:57 GMT
server
AmazonS3
date
Sat, 20 Feb 2021 17:40:00 GMT
vary
Origin
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 9569de78dc2ca85c5ba29cb17f0eb7ce.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
ZAG50-C1
x-amz-cf-id
ESRKgj_V2GJ2BeMbZv3trPkXfr_UXosC3oSs3pVTPbh76Jr2U8fQDg==
wrap.js
confiant-integrations.global.ssl.fastly.net/gpt/202102081224/ Frame 5C26
192 KB
58 KB
Script
General
Full URL
https://confiant-integrations.global.ssl.fastly.net/gpt/202102081224/wrap.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/Fseez_-nDyWQXIJsbnoKkKTHXC4/gpt_and_prebid/config.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
739b8c85a7fc66c5641f1849342de96a73282d51607ad717c257721a7d1c16d2

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:06 GMT
Content-Encoding
gzip
Age
406
X-Cache
HIT
Connection
keep-alive
Content-Length
58698
x-amz-id-2
6raGJjzTDt/qYsf/rJGLsqxuQFeKjva8brcxp1GLqbu+p1W/vp2XZ/FWg5tIwT8tBYeS0Bq8rOo=
X-Served-By
cache-hhn4054-HHN
Last-Modified
Mon, 08 Feb 2021 17:25:38 GMT
Server
AmazonS3
X-Timer
S1613842807.961671,VS0,VE0
ETag
"23e6110cec5ae2cc41810f692912d122"
x-amz-request-id
AC74391B61F79435
Via
1.1 varnish
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
479
wrap.js
confiant-integrations.global.ssl.fastly.net/prebid/202102081224/ Frame 5C26
81 KB
27 KB
Script
General
Full URL
https://confiant-integrations.global.ssl.fastly.net/prebid/202102081224/wrap.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/Fseez_-nDyWQXIJsbnoKkKTHXC4/gpt_and_prebid/config.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
139d766485744bb7720e1a2d7b6bc03230fb87cb88c7f2c8fcab180d8875a221

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:07 GMT
Content-Encoding
gzip
Age
684
X-Cache
HIT
Connection
keep-alive
Content-Length
27131
x-amz-id-2
BgyuieTSUrnB5TGbC5n/h7ol8AtQBZ+eWFsOn3m0YVyVXeGJu7MzIWRP4MzCyKrPXm3EzlESYes=
X-Served-By
cache-hhn4054-HHN
Last-Modified
Mon, 08 Feb 2021 17:25:40 GMT
Server
AmazonS3
X-Timer
S1613842807.013801,VS0,VE0
ETag
"79823576a28bd9e5709f6ebe7e661442"
x-amz-request-id
C120A040909802AE
Via
1.1 varnish
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
890
log.gif
includemodal.com/static/ Frame 5C26
42 B
199 B
Image
General
Full URL
https://includemodal.com/static/log.gif?logger=1&token=1613842806587&url=https://confiant-integrations.global.ssl.fastly.net/gpt/202102081224/wrap.js&o=https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.148.110 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
last-modified
Thu, 26 Sep 2019 18:10:35 GMT
server
nginx/1.10.3 (Ubuntu)
accept-ranges
bytes
etag
"5d8cff1b-2a"
content-length
42
content-type
image/gif
log.gif
includemodal.com/static/ Frame 5C26
42 B
199 B
Image
General
Full URL
https://includemodal.com/static/log.gif?logger=1&token=1613842806587&url=https://confiant-integrations.global.ssl.fastly.net/prebid/202102081224/wrap.js&o=https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.148.110 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
last-modified
Thu, 26 Sep 2019 18:10:35 GMT
server
nginx/1.10.3 (Ubuntu)
accept-ranges
bytes
etag
"5d8cff1b-2a"
content-length
42
content-type
image/gif
translator
hbopenbid.pubmatic.com/ Frame 5C26
0
122 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.southbendtribune.com
date
Sat, 20 Feb 2021 17:30:10 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 5C26
239 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17062&site_id=156734&zone_id=747340&size_id=2&alt_size_ids=1&rp_schain=1.0,1!insticator.com,4cd377bb-c455-40c0-9c7a-667505450792,1,,,&rf=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&tk_flint=pbjs_lite_v3.27.1&x_source.tid=f8b26eb7-ffad-4a90-898c-6380f2644c8d&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8112727160647415
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
2791b9d3fb2ef16454735dbba6ac95b0ebc83cd42685451c94c369d7f815d4eb

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:07 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.southbendtribune.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
239
Expires
Wed, 17 Sep 1975 21:32:10 GMT
mvo
tag.1rx.io/rmp/74418/0/ Frame 5C26
0
281 B
XHR
General
Full URL
https://tag.1rx.io/rmp/74418/0/mvo?z=1r&hbv=3.27.1,2.1
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.19.147.210 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.southbendtribune.com
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:07 GMT
Cache-Control
private, max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Server
Tengine
Connection
keep-alive
hb
ice.360yield.com/ Frame 5C26
98 B
521 B
XHR
General
Full URL
https://ice.360yield.com/hb?jsonp=%7B%22bid_request%22%3A%7B%22secure%22%3A1%2C%22id%22%3A%223584c18911c7cfc%22%2C%22version%22%3A%227.1.0-JS-6.3.0%22%2C%22referrer%22%3A%22https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22insticator.com%22%2C%22sid%22%3A%224cd377bb-c455-40c0-9c7a-667505450792%22%2C%22hp%22%3A1%7D%5D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%228060e462977735%22%2C%22pid%22%3A%2222111523%22%2C%22tid%22%3A%22d76f4e34-de43-482c-996f-2791004045a7%22%2C%22banner%22%3A%7B%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%7D%5D%7D%7D%5D%7D%7D
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.167.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
433456e338fa091aca5d48e42618ed1a5d093927b76e4cf5c3f0e589811c7fc3

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.southbendtribune.com
date
Sat, 20 Feb 2021 17:40:07 GMT
access-control-allow-credentials
true
content-type
application/json; charset=UTF-8
content-length
98
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cygnus
htlb.casalemedia.com/ Frame 5C26
23 B
528 B
XHR
General
Full URL
https://htlb.casalemedia.com/cygnus?s=297143&v=7.2&r=%7B%22id%22%3A%22992b6412dfd48%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22106f32c7f715151%22%2C%22ext%22%3A%7B%22siteID%22%3A%22297143%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A0%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22insticator.com%22%2C%22sid%22%3A%224cd377bb-c455-40c0-9c7a-667505450792%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%7D&ac=j&sd=1
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-181.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0e78d0cfae1b0857bfab2d67dd19daac2aa23e6bebea11f2c10cee911be91e18

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
x-ak-initial-geo
CC:[CH], RC:[ZH], CN:[EU], CIP:[195.242.213.99], XFF:[]
server
Apache
vary
Is-Traffic-Invalid,Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
access-control-allow-origin
https://www.southbendtribune.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-type
application/json
content-length
43
x-ak-client-geo
12
expires
Sat, 20 Feb 2021 17:40:07 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 5C26
19 B
721 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:07 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.48:80
AN-X-Request-Uuid
9ffdf15e-4caa-4638-be81-8b54375e04e5
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.southbendtribune.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 5C26
19 B
722 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:07 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.146:80
AN-X-Request-Uuid
bfca7b3c-f766-4741-b62b-8e4be1e57bd9
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.southbendtribune.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
dmx.districtm.io/b/ Frame 5C26
0
431 B
XHR
General
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD, POST, OPTIONS
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-credentials
true
cf-ray
624a02c84f49cc36-ZRH
access-control-allow-headers
Content-Type, Origin
cf-request-id
08622011320000cc36ed0e9000000001
imp
g2.gumgum.com/hbid/ Frame 5C26
576 B
1 KB
XHR
General
Full URL
https://g2.gumgum.com/hbid/imp?si=18045&pi=3&schain=1.0%2C1!insticator.com%2C4cd377bb-c455-40c0-9c7a-667505450792%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%223.27.1%22%7D&ogu=null&ns=10240
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.129.8.178 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
16866952047175703f35c9442249205b4e18118ab9ebc311eb1fd22681946a8d

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
server
nginx
timing-allow-origin
*
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.southbendtribune.com
cache-control
private, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-type
application/json;charset=UTF-8
expires
0
/
hb.emxdgt.com/ Frame 5C26
0
316 B
XHR
General
Full URL
https://hb.emxdgt.com/?t=3000&ts=1613842807034&src=pbjs
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.104.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sat, 20 Feb 2021 17:40:06 GMT
Content-Type
text/html
Access-Control-Allow-Origin
https://www.southbendtribune.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Access-Control-Allow-Headers
security, Content-Type
Content-Length
0
trinity.json
apex.go.sonobi.com/ Frame 5C26
501 B
2 KB
XHR
General
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2222e687b9d34e414%22%3A%2276795fc5b7de0e74fce0%7C728x90%22%7D&ref=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&s=3bd83af2-94e7-402c-a209-f0b2059ded91&pv=5519b79c-ba48-442f-a165-661d4b09e06a&vp=mobile&lib_name=prebid&lib_v=3.27.1&us=3&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22insticator.com%22%2C%22sid%22%3A%224cd377bb-c455-40c0-9c7a-667505450792%22%2C%22hp%22%3A1%7D%5D%7D
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
sonobi-go /
Resource Hash
87f1df7cbadc9df5fdf4257e08c09a28822586ea51f47667ea75865d8723e2c7
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:07 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://www.southbendtribune.com
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
354
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
hb
ssc.33across.com/api/v1/ Frame 5C26
66 B
653 B
XHR
General
Full URL
https://ssc.33across.com/api/v1/hb
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.4.152.106 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-152-106.compute-1.amazonaws.com
Software
/ 33Across
Resource Hash
8e6809f0262845e28fe19045e7d7e825f2bae06f76f05c9765f3ac6cbe1b6680

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-credentials
true
arj
insticator-d.openx.net/w/1.0/ Frame 5C26
172 B
360 B
XHR
General
Full URL
https://insticator-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=145fd001-cd8c-402c-affc-70bc688507b1&nocache=1613842807038&schain=1.0%2C1!insticator.com%2C4cd377bb-c455-40c0-9c7a-667505450792%2C1%2C%2C%2C&aus=728x90&divIds=div-insticator-ad-4&auid=540833000
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
33779495e1de2a932e44751cfe4a114dee09a81b2987863b38a334821264646c

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
server
OXGW/16.202.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.southbendtribune.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
163
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
bid
ap.lijit.com/rtb/ Frame 5C26
24 B
768 B
XHR
General
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_3.27.1
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx /
Resource Hash
b2b95d6c1d88536f7f76843a3f9774ada1b2187e9c633b49a1546e508a21b389

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sat, 20 Feb 2021 17:40:07 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://www.southbendtribune.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap1ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
header
hb.aralego.com/ Frame 5C26
0
333 B
XHR
General
Full URL
https://hb.aralego.com/header?ver=ADGENT_PREBID-2018011501&ifr=0&bl=en-US&je=1&dnt=0&adid=ad-8A2A7A833A3866BB099D4B6286ED748&tdid=&schain=1.0%2C1!insticator.com%2C4cd377bb-c455-40c0-9c7a-667505450792%2C1%2C%2C%2C&fp=undefined&host=www.southbendtribune.com&u=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&xr=0&ao=https%3A%2F%2Fwww.southbendtribune.com&ucfUid=b6078732-2b05-4322-8390-c892875268f8&w=728&h=90
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.210.196.208 Alexandria, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.southbendtribune.com
date
Sat, 20 Feb 2021 17:40:07 GMT
access-control-allow-credentials
true
connection
close
prebid
ib.adnxs.com/ut/v3/ Frame 5C26
19 B
721 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:07 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.48:80
AN-X-Request-Uuid
c0580f67-0b29-4fda-a846-7bc8af2090e4
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.southbendtribune.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
c
prebid.a-mo.net/a/ Frame 5C26
0
164 B
XHR
General
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
136.144.59.88 Secaucus, United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

x-nbr
1
date
Sat, 20 Feb 2021 17:40:07 GMT
server
envoy
vary
origin
access-control-allow-origin
https://www.southbendtribune.com
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
bid
c.amazon-adsystem.com/e/dtb/ Frame 5C26
23 B
379 B
XHR
General
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&pid=zWIq246sd4KRp&cb=0&ws=728x90&v=7.59.00&t=3000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F27794161%2Fwral.com_Web_728x90_1%22%7D%5D&cfgv=0&pubid=70fb13d1-ab65-42ac-a7ca-0b4e680d5c92&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.24.128 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
via
1.1 384bf15c1ac91d451725d766417680b1.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
ZAG50-C1
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
3OCxdrxZ9RDzTBkAdM9mIIYQw_8fJFaAIBWDdkzKHHESiJBcwbEmBA==
pixel.gif
dh014lg6uwepv.cloudfront.net/ Frame 5C26
35 B
351 B
Image
General
Full URL
https://dh014lg6uwepv.cloudfront.net/pixel.gif?timestamp=1613842807007&site_uuid=136953cb-88f9-48b3-9417-8f28d8a3cf54&hostname=www.southbendtribune.com&ad_unit=wral.com_Web_728x90_1&impression_type=il&device=desktop&country_code=UNKNOWN
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:8800:1a:5302:20c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:08 GMT
via
1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
last-modified
Tue, 10 Sep 2019 16:08:28 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-C2
etag
"28d6814f309ea289f847c69cf91194c6"
x-cache
Hit from cloudfront
content-type
image/gif
accept-ranges
bytes
content-length
35
x-amz-cf-id
irhwkOFCS5kiDeIWWcBn5GvlHbupY0XZ09c0U2y4FJfnIvyr2XE6Cw==
log.gif
includemodal.com/static/ Frame 5C26
42 B
199 B
Image
General
Full URL
https://includemodal.com/static/log.gif?logger=1&token=1613842806587&url=https://dh014lg6uwepv.cloudfront.net/pixel.gif?timestamp=1613842807007&site_uuid=136953cb-88f9-48b3-9417-8f28d8a3cf54&hostname=www.southbendtribune.com&ad_unit=wral.com_Web_728x90_1&impression_type=il&device=desktop&country_code=UNKNOWN&o=https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.148.110 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
last-modified
Thu, 26 Sep 2019 18:10:35 GMT
server
nginx/1.10.3 (Ubuntu)
accept-ranges
bytes
etag
"5d8cff1b-2a"
content-length
42
content-type
image/gif
gpt.js
www.googletagservices.com/tag/js/ Frame 5C26
57 KB
19 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae8cbb5a571c9cc66da64cf7e32b9d1d74cc1a4f98b89fea7a8c23798fd6e901
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"789 / 457 of 1000 / last-modified: 1613776261"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19524
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:07 GMT
pubads_impl_2021021601.js
securepubads.g.doubleclick.net/gpt/ Frame 5C26
291 KB
102 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021601.js?31060172
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/prebid/202102081224/wrap.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
sffe /
Resource Hash
94107238a1097b66d59ded9c22a26e793aaa854e8bd4f555e704aa23acb6b959
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 16 Feb 2021 09:41:55 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
104204
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:07 GMT
integrator.js
adservice.google.de/adsid/ Frame 5C26
109 B
127 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.southbendtribune.com
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/prebid/202102081224/wrap.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 5C26
109 B
150 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.southbendtribune.com
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/prebid/202102081224/wrap.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame 5C26
31 KB
11 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2507036722612372&correlator=3146504230101121&output=ldjh&impl=fif&eid=21068773%2C21068891%2C21069112%2C31060172&vrg=2021021601&ptt=17&sc=1&sfv=1-0-37&ecs=20210220&iu_parts=27794161%2Cwral.com_Web_728x90_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C468x60&prev_scp=h%3D17%26shb%3D1%26tg%3D0%26amznbid%3D2%26amznp%3D2%26p%3DBTF%26Exclude_Adx%3DN%26ib%3Dnofill%26iba%3D0%26iaid%3Dnofill%26it%3Dil&cookie=ID%3D824d9cf20879a17a%3AT%3D1613842804%3AS%3DALNI_MYNW-znwf44pX4Xa5S96EQwThuqLQ&cdm=www.southbendtribune.com&bc=31&abxe=1&lmt=1613842807&dt=1613842807703&dlt=1613842806477&idt=1187&ea=0&frm=23&biw=1600&bih=1200&isw=728&ish=90&oid=3&adxs=436&adys=2784&adks=1627582656&ucis=fgxuj4vrly09&ifi=1&ifk=3585281228&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=3&url=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&top=https%3A%2F%2Fwww.southbendtribune.com%2Fnews%2Fbusiness%2Felkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn%2Farticle_47a83152-829f-5896-928e-0ba21367ef33.html&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x-1&ga_vid=165670266.1613842808&ga_sid=1613842808&ga_hid=1436407602&fws=256&ohw=0&btvi=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021601.js?31060172
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
605311e1f4f120e6ad09cb144a9d0f52df7a8c913ee252fa865ceee7b17d3af1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11509
x-xss-protection
0
google-lineitem-id
5449351360
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138320957668
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.southbendtribune.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
edfb28179cb35161b9812e7370c51d1f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 5C26
0
0
Other
General
Full URL
https://edfb28179cb35161b9812e7370c51d1f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=3
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/prebid/202102081224/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 5C26
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=3
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/prebid/202102081224/wrap.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

activeview
pagead2.googlesyndication.com/pcs/ Frame 3031
42 B
94 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv6Y3E2tzx4_8ow4-pL5NHzz8zgeXv05oXBrXFvFxiY93QD0RIQtDIvLYo2UwnuqU7Ku1Ew7JCrMd51BjyYt5rDPS5MO9mwYZj9_9TV5Z6pYy-8z7s8XZ_AByY&sai=AMfl-YScJJwb0eYUA0tplypDK4Vcg6MpiVF_Oo9iOdSRzUN3cv9ZsEtF8L5R0ZUQsxLvSqeFgERvSX-ZoFa_vX8wa7x0vJ4308i-g4zMkoZ0woR7gfjrtC6Dt4qD4F-X&sig=Cg0ArKJSzIYqeyIBiJlyEAE&cid=CAASFeRooye0CEarpQSvYEQj-wwGj5TVpQ&id=ampim&o=436,136&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1008&mtos=0,0,1008,1008,1008&tos=0,0,1008,0,0&tfs=141&tls=1149&g=100&h=100&tt=1150&r=v&avms=ampa&adk=2405988686
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:07 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 5C26
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssQ1ahq2WHQHmSAQeSslDjzZU6kCIf7-ktZv6Z92MVXQTTRN7YSQTIbxEqZ6IHJ6wuywLPs1iIMHFmZTnceE9UEHIcjbS7CYL5Tik6kLo_wGXMh6KmOm88HHQs0Y54BI7KDx1Qi5wVdT3seYYLjCxHGLKpDUXTQ6kdy3O2Pti7g3NY5zOAAyRJ8za07hvJMp36B6_1koiojzSrsiKVvFyBz_vNAWctXKy6D3sT1sDlIihMegk4aduuMHWatlEODG-OJBCKV7dk_21SjasCKOXJm9eWzOoHHQsEMryUYMruTDoP1UYayXFIjdY-_nRlZjsO6XJSoUbjReDYHJA&sig=Cg0ArKJSzG-DOrUYxgW6EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:07 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:07 GMT
event
event.insticator.com/v1/ Frame 5C26
0
126 B
XHR
General
Full URL
https://event.insticator.com/v1/event?event_name=event_pageview
Requested by
Host: d3lcz8vpax4lo2.cloudfront.net
URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.200.180.114 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Allow-Origin
*
Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/json

Response headers

access-control-allow-origin
https://www.southbendtribune.com
date
Sat, 20 Feb 2021 17:40:08 GMT
access-control-allow-credentials
true
content-length
0
vary
Origin
event
event.insticator.com/v1/ Frame
0
0
Other
General
Full URL
https://event.insticator.com/v1/event?event_name=event_pageview
Protocol
H2
Server
52.200.180.114 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
access-control-allow-origin,content-type
Origin
https://www.southbendtribune.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
content-length
0
vary
Origin
access-control-max-age
3600
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-headers
access-control-allow-origin,content-type
access-control-allow-methods
POST
access-control-allow-credentials
true
gen_204
pagead2.googlesyndication.com/pagead/ Frame 5C26
0
23 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&pvsid=2507036722612372&r=728x90%7C468x60&w=728&h=90&a=0
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:07 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 55ED
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstgU4W6dO-RHzg1fW9A7LAixM-BiX4pGe4LxlH_COjE_aeAxAdilpoZhtcWgrZcv8kOcWKrgeCcA_2eBrDZesGyGRTui1ngOGm-VjlPxW0jxqez5htodoLK7GUPpTYFkvYrSmGTvFK-d_otpJ02pTAADkn3nJYCJDwC5gD7eyCqvadWMt1ruJzGaE02DZUzDFrbu6xg214TL4vomihEL1nWBsSiAzDLyuFURV4d8VY_0JR9qPDBohXjdgDifX3PIgS7vPnWsga8iGZI15nbYFCuU7wx05RTG1qrsHIwTHK7_uRAGt59Rn3EiNVV9je2sBs&sig=Cg0ArKJSzOphWx0kbrj2EAE&adurl=
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:07 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210211/r20110914/ Frame 55ED
18 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210211/r20110914/abg_lite_fy2019.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4db6732268b3d9330df1068351b18e2fd1c1c6da87b5953259b022a19ddfe7a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 16:56:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2632
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7377
x-xss-protection
0
server
cafe
etag
10747045913157086108
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sat, 06 Mar 2021 16:56:15 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/ Frame 55ED
3 KB
2 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/window_focus_fy2019.js
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
873aed697d352242a06cc0e1961d2503173d4cbe93713671731d6b8928961745
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:03:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2190
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1546
x-xss-protection
0
server
cafe
etag
8852521427838746165
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sat, 06 Mar 2021 17:03:37 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 55ED
107 KB
33 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae35469a2de645d561d555105d21f075e0469c83a7bd02ebc9547d4d5b616f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1613565156040306"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33368
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:07 GMT
l
www.google.com/ads/measurement/ Frame 55ED
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQhIbccTmam2UvcGLZTTve5qOfbwq6B5XmgV57nY1LUKrlZwEhb7kryF46ACgjlTnVMz2y5MO9E5awtaUSBP48hZIVaGA
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

4068546183806204155
tpc.googlesyndication.com/simgad/ Frame 55ED
12 KB
12 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/4068546183806204155
Requested by
Host: www.southbendtribune.com
URL: https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
744ff524d1ce233b0d7f09c86d6ef081fd162cd6187c8cc9df59af32f26d6081
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 15 Feb 2021 16:23:08 GMT
x-content-type-options
nosniff
age
436619
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11795
x-xss-protection
0
last-modified
Wed, 19 Aug 2020 16:18:02 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 15 Feb 2022 16:23:08 GMT
osd.js
www.googletagservices.com/activeview/js/current/ Frame 5C26
74 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021601.js?31060172
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1143bb5ae891056f59482184346b0fe47d8e95c9e0f159f023bf0f95ec45222d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1613565174175677"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28346
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:07 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 5C26
8 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021021601&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021601.js?31060172
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a3b1a1f928c73e61c1e55b89ceabfddb5ea31ef247373a944c4e56004758b220
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6396
x-xss-protection
0
truncated
/ Frame 55ED
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
295a264be79dd8589a145fd75891c349ecd49565ca551e4cd7c276c1ce8f2343

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 5C26
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/prebid/202102081224/wrap.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1611170586013198"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6403
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:08 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 55ED
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssZqqf4NVn1nff_LMVejP3CblZZ5tC1J_Yn0LLdAfr2cQE9N91csQ7bxkeA65JggEIcsxg7r3EtTHMfznz9SayYlO0jDswR5_t3d5D3O_lE9m1Npl5pJoBfozzRHjyshjdf-hWTzW-vPcPxzR47UFOpy775PrYRYwGR7OJnbz8f8LK6byj7PCivzTdjYqYtVu4gUQ_0tCNbfKmw9KBHQE2ghr1S2bPWR8fI1bJvg59__cnhD4dj9SWHkzXMCLnQxkU6WaW48V6TgJXCzKnJGylGeVJQHOFde7Hbu2-M7_9rleIKvrVcu2hedXieDn0vkz1gXg&sig=Cg0ArKJSzH1IiXQ1LosmEAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 20 Feb 2021 17:40:08 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 20 Feb 2021 17:40:08 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 840E
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/prebid/202102081224/wrap.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/221/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
4984
date
Sat, 20 Feb 2021 16:57:53 GMT
expires
Sun, 20 Feb 2022 16:57:53 GMT
last-modified
Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
2535
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
pagead2.googlesyndication.com/bg/ Frame 840E
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/-3PV2TBX5k4pcSnShz_dD7g-pd6mO_d82H6QQa9Z28c.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fb73d5d93057e64e297129d2873fdd0fb83ea5dea63bf77cd87e9041af59dbc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 07:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 09 Feb 2021 09:15:00 GMT
server
sffe
age
207968
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6187
x-xss-protection
0
expires
Fri, 18 Feb 2022 07:54:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 5C26
0
46 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021021601&jk=2507036722612372&bg=!Q0ClQAPNAAXRs2QT0TsAKQB2-DxaR3OOJe9cyx8XXgfGW5hvOOle8OKjsGsbJMrePQgdFPaMHsJ9AgAAAFhSAAAAEGgBBwoA0qWq-PHCMO2eWwydFrzv9IrZauNHrylAhTcyqy4AS-nzzf2QAAdc_jrpUSZQDMPECS0v8hc-U8QLivJYSPYeRoXoE-uxjzFY2Xdz7WxHA1I3sl-pHWiAq8dhs8rm-YZsqqoofnNaBfxoc58PGjwOVhD9KrTFMfu2SMSc8JH4BaWQ3xuE-uuOUZt-Rt8O1pvXDTKQJAh2OyAtv1rXyBU-vGPRPiAUUoB7LHGuBkiyFXEnToWqjtYdWNMshMFQr3XxsKbdmbXZc6qAxRAh1VIl1hlcFJkCRRxVu-sNwYHpd4B9_sGBQulCTz9LZPlX8uE3uid8LDh1OpeLLC51tJImcdUIar8lt15P_joiqnIQ8HbK7beXWkH8Uk_RmLF1wwGqNPfcjKG-Q14lRzf9xW8ITBUWCkPcayoa4eMH50yK6AScSE0VksnW4TT9AjmUwEmvVcZPQJsq34sgYrwRXujrXXLpbB44ZcRa9BCJGVI9BMGOmQESyM7uIgLKqkUTf4M65T8EYrO1H0N6uE5qstAwrMHyZimG7o7AOxc0C3MqrsKESjW0MCsiDL2A_iBtHLPhofHTmyY0nUxAleU-eVLGzxrlUG_j3-F3MK4aXVv7Ys4B_XtKo3_POLv0_-uJQYYqDmv6QxKMY9eviWyEcS0W2lCzMUnU6YzfJAe8PxFhY3icC3n5yOmFDia7KhlVzR0SQNtoQyPmKZ-gdMtYest5nenvCmWitmeAue1CGVExMP84AMuqU7ZEEwUKOS1_v81_4TOl4K9NjUrKVfo_i1o3ElneaI8kPUiKv3KOo0NIPvnoKKgMH_zS2aAHefdDQaiYz4trIFCVZ8gjbBXgwYetBm96R7JgxAsaLc_soQ3KbXDmQ235xT1Lkl431rTp58uxdiHMKEGKSDJcYKg57OqeOWU8Wl1DqruEUI6_EFPy5hty-1sC_6EXtsIprEk2b6vEORz8S7n4lI8Tmd7LPn7tge7nIhi4BBHrLC133cYKhDfJIhjfk1ikLm8r50Wsre0iis0HmQ7aimjti2YW-UHqCimqdjqODdH6uAQm
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:08 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 895A
Redirect Chain
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=51113032-2363-4e94-85a5-f312b07cd114&gdpr=0
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=fa046031-4974-4c00-b096-c7a8abf87be8
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=fa046031-4974-4c00-b096-c7a8abf87be8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:08 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Sat, 20 Feb 2021 17:40:07 GMT
Server
MT3 3518 2f03077 master zrh-pixel-x24
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=fa046031-4974-4c00-b096-c7a8abf87be8
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sat, 20 Feb 2021 17:40:06 GMT
sd
us-u.openx.net/w/1.0/ Frame 3595
Redirect Chain
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=51113032-2363-4e94-85a5-f312b07cd114&gdpr=0
  • https://match.prod.bidr.io/cookie-sync/ox
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFENGJFN0FZcE1BQUJBS1duQ2tOdw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&b...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAD4bE7AYpMAABAKWnCkNw&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2&_bee_ppp=1
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAAcsU7AYpMAABD5HCqdPw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_curre...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp%2Cox&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=7403304255767454958
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAGsoU7AYpMAAA_m7fI3SQ&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D7403304255767454958%26bee_sync_partners%3Dox%26bee_sync...
  • https://match.prod.bidr.io/cookie-sync?userid=7403304255767454958&bee_sync_partners=ox&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AAGsoU7AYpMAAA_m7fI3SQ&pid=558502&d...
  • https://us-u.openx.net/w/1.0/sd?id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?cc=1&id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:10 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?cc=1&id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
date
Sat, 20 Feb 2021 17:40:10 GMT
via
1.1 google
server
OXGW/16.202.0
alt-svc
clear
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
setuid
x.yieldlift.com/ Frame 3595
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fx.yieldlift.com%252Fsetuid%253Fbidder%253Dadnxs%2526gdpr%253D%2526gdpr_consent%253D%2526us_privacy%253D%2526uid%253D%2524UID
  • https://x.yieldlift.com/setuid?bidder=adnxs&gdpr=&gdpr_consent=&us_privacy=&uid=5108492245175821146
0
570 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=adnxs&gdpr=&gdpr_consent=&us_privacy=&uid=5108492245175821146
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:08 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.151:80
AN-X-Request-Uuid
ae84b5ac-d0cf-42d5-ae61-54d81d3cd634
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://x.yieldlift.com/setuid?bidder=adnxs&gdpr=&gdpr_consent=&us_privacy=&uid=5108492245175821146
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
setuid
x.yieldlift.com/ Frame 3595
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=&gdpr_consent=&us_privacy=
  • https://x.yieldlift.com/setuid?bidder=rubicon&uid=KLE0C5XF-8-A3SZ
0
570 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=rubicon&uid=KLE0C5XF-8-A3SZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://x.yieldlift.com/setuid?bidder=rubicon&uid=KLE0C5XF-8-A3SZ
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Expires
0
setuid
x.yieldlift.com/ Frame 3595
Redirect Chain
  • https://sync.go.sonobi.com/us.gif?loc=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dsonobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%5BUID%5D
  • https://x.yieldlift.com/setuid?bidder=sonobi&gdpr=&gdpr_consent=&us_privacy=&uid=ecce6c49-7289-4f44-94f4-95bebfb4e207
0
598 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=sonobi&gdpr=&gdpr_consent=&us_privacy=&uid=ecce6c49-7289-4f44-94f4-95bebfb4e207
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:09 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://x.yieldlift.com/setuid?bidder=sonobi&gdpr=&gdpr_consent=&us_privacy=&uid=ecce6c49-7289-4f44-94f4-95bebfb4e207
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
setuid
x.yieldlift.com/ Frame 3595
Redirect Chain
  • https://cs.emxdgt.com/um?ssp=pbs&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Demx_digital%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24UID
  • https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Demx_digital%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24E...
  • https://cs.emxdgt.com/umcheck?apnxid=421273563502918358&redirect=https://x.yieldlift.com/setuid?bidder=emx_digital&gdpr=&gdpr_consent=&us_privacy=&uid=$EMXUID
  • https://x.yieldlift.com/setuid?bidder=emx_digital&uid=421273563502918358brt66031613842809065503f1
0
714 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=emx_digital&uid=421273563502918358brt66031613842809065503f1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

location
https://x.yieldlift.com/setuid?bidder=emx_digital&uid=421273563502918358brt66031613842809065503f1
date
Sat, 20 Feb 2021 17:40:08 GMT
content-length
0
content-type
text/html
setuid
x.yieldlift.com/ Frame 3595
Redirect Chain
  • https://sync.1rx.io/usersync2/rmphb?gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Drhythmone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%5BRX_UUID%5D
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8408571935
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8408571935
  • https://sync.1rx.io/usersync/tradedesk/9179d561-553f-4cea-8fc7-7ee46a16b2f5
  • https://sync.targeting.unrulymedia.com/csync/RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003?redir=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Drhythmone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3...
  • https://x.yieldlift.com/setuid?bidder=rhythmone&gdpr=&gdpr_consent=&us_privacy=&uid=RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003
0
814 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=rhythmone&gdpr=&gdpr_consent=&us_privacy=&uid=RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

Date
Sat, 20 Feb 2021 17:40:09 GMT
Server
Tengine
ETag
RXb9fc2bad1d784500991b36f3afa3e3c3003
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location
https://x.yieldlift.com/setuid?bidder=rhythmone&gdpr=&gdpr_consent=&us_privacy=&uid=RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003
Connection
keep-alive
Content-Type
text/html
setuid
x.yieldlift.com/ Frame 5A08
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fx.yieldlift.com%252Fsetuid%253Fbidder%253Dadnxs%2526gdpr%253D%2526gdpr_consent%253D%2526us_privacy%253D%2526uid%253D%2524UID
  • https://x.yieldlift.com/setuid?bidder=adnxs&gdpr=&gdpr_consent=&us_privacy=&uid=421273563502918358
0
570 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=adnxs&gdpr=&gdpr_consent=&us_privacy=&uid=421273563502918358
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:09 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.77:80
AN-X-Request-Uuid
521cba0a-fb5e-459d-a2e2-47e7614d8440
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://x.yieldlift.com/setuid?bidder=adnxs&gdpr=&gdpr_consent=&us_privacy=&uid=421273563502918358
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
setuid
x.yieldlift.com/ Frame 5A08
Redirect Chain
  • https://sync.go.sonobi.com/us.gif?loc=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dsonobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%5BUID%5D
  • https://x.yieldlift.com/setuid?bidder=sonobi&gdpr=&gdpr_consent=&us_privacy=&uid=ecce6c49-7289-4f44-94f4-95bebfb4e207
0
598 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=sonobi&gdpr=&gdpr_consent=&us_privacy=&uid=ecce6c49-7289-4f44-94f4-95bebfb4e207
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:09 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://x.yieldlift.com/setuid?bidder=sonobi&gdpr=&gdpr_consent=&us_privacy=&uid=ecce6c49-7289-4f44-94f4-95bebfb4e207
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
setuid
x.yieldlift.com/ Frame 5A08
Redirect Chain
  • https://cs.emxdgt.com/um?ssp=pbs&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Demx_digital%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24UID
  • https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Demx_digital%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24E...
  • https://cs.emxdgt.com/umcheck?apnxid=421273563502918358&redirect=https://x.yieldlift.com/setuid?bidder=emx_digital&gdpr=&gdpr_consent=&us_privacy=&uid=$EMXUID
  • https://x.yieldlift.com/setuid?bidder=emx_digital&uid=421273563502918358brt66031613842809065503f1
0
714 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=emx_digital&uid=421273563502918358brt66031613842809065503f1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

location
https://x.yieldlift.com/setuid?bidder=emx_digital&uid=421273563502918358brt66031613842809065503f1
date
Sat, 20 Feb 2021 17:40:08 GMT
content-length
0
content-type
text/html
sd
us-u.openx.net/w/1.0/ Frame 5A08
Redirect Chain
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=51113032-2363-4e94-85a5-f312b07cd114&gdpr=0
  • https://match.prod.bidr.io/cookie-sync/ox
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCQWJVN0FZcE1BQUFfWUJGREdvZw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&b...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABAbU7AYpMAAA_YBFDGog&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2&_bee_ppp=1
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAGsoU7AYpMAAA_m7fI3SQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_curre...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp%2Cox&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=5540819673863955520
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAGsoU7AYpMAAA_m7fI3SQ&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D5540819673863955520%26bee_sync_partners%3Dox%26bee_sync...
  • https://match.prod.bidr.io/cookie-sync?userid=5540819673863955520&bee_sync_partners=ox&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AAGsoU7AYpMAAA_m7fI3SQ&pid=558502&d...
  • https://us-u.openx.net/w/1.0/sd?id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?cc=1&id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:10 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?cc=1&id=537125688&val=AAGsoU7AYpMAAA_m7fI3SQ
date
Sat, 20 Feb 2021 17:40:10 GMT
via
1.1 google
server
OXGW/16.202.0
alt-svc
clear
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
setuid
x.yieldlift.com/ Frame 5A08
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=&gdpr_consent=&us_privacy=
  • https://x.yieldlift.com/setuid?bidder=rubicon&uid=KLE0C5XF-8-A3SZ
0
674 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=rubicon&uid=KLE0C5XF-8-A3SZ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://x.yieldlift.com/setuid?bidder=rubicon&uid=KLE0C5XF-8-A3SZ
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Expires
0
setuid
x.yieldlift.com/ Frame 5A08
Redirect Chain
  • https://sync.1rx.io/usersync2/rmphb?gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Drhythmone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%5BRX_UUID%5D
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3978949281
  • https://sync.1rx.io/usersync/tradedesk/9179d561-553f-4cea-8fc7-7ee46a16b2f5
  • https://sync.targeting.unrulymedia.com/csync/RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003?redir=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Drhythmone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3...
  • https://x.yieldlift.com/setuid?bidder=rhythmone&gdpr=&gdpr_consent=&us_privacy=&uid=RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003
0
814 B
Image
General
Full URL
https://x.yieldlift.com/setuid?bidder=rhythmone&gdpr=&gdpr_consent=&us_privacy=&uid=RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.211.21.136 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept
application/json
Pragma
no-cache
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
application/json;charset=utf-8

Redirect headers

Date
Sat, 20 Feb 2021 17:40:09 GMT
Server
Tengine
ETag
RXb9fc2bad1d784500991b36f3afa3e3c3003
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location
https://x.yieldlift.com/setuid?bidder=rhythmone&gdpr=&gdpr_consent=&us_privacy=&uid=RX-b9fc2bad-1d78-4500-991b-36f3afa3e3c3-003
Connection
keep-alive
Content-Type
text/html
369.json
id5-sync.com/g/v2/ Frame 5C26
346 B
1 KB
XHR
General
Full URL
https://id5-sync.com/g/v2/369.json?gdpr_consent=&gdpr=0
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.75.146.200 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
c7919f3da91c12d38109af53dad27cebf1bd7a3489ff07adf1b7ad772abe7a01
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sat, 20 Feb 2021 17:40:12 GMT
Vary
Origin
P3P
CP="CAO PSA OUR"
Access-Control-Allow-Origin
https://www.southbendtribune.com
Access-Control-Allow-Credentials
true
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
Transfer-Encoding
chunked
envelope
api.rlcdn.com/api/identity/ Frame 5C26
0
203 B
XHR
General
Full URL
https://api.rlcdn.com/api/identity/envelope?pid=88
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.207.148 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 20 Feb 2021 17:40:13 GMT
via
1.1 google
alt-svc
clear
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://www.southbendtribune.com
access-control-allow-credentials
true
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length
0
sync.html
cdn.aralego.net/ucfad/cookie/ Frame 1E7B
2 KB
1 KB
Document
General
Full URL
https://cdn.aralego.net/ucfad/cookie/sync.html
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:467 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4cc2c709011178c06e10f7c74ba463f3e4df26d12c2b11809287f6a9a352f50

Request headers

:method
GET
:authority
cdn.aralego.net
:scheme
https
:path
/ucfad/cookie/sync.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

date
Sat, 20 Feb 2021 17:40:13 GMT
content-type
text/html
set-cookie
__cfduid=db28ff5b360271b8221eb536319d4c2ce1613842813; expires=Mon, 22-Mar-21 17:40:13 GMT; path=/; domain=.aralego.net; HttpOnly; SameSite=Lax
last-modified
Wed, 16 Dec 2020 08:30:52 GMT
access-control-allow-credentials
true
cache-control
max-age=14400
cf-cache-status
HIT
age
1554
cf-request-id
0862202aa700004e68aba9a000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vPZalCQcOnJjPDtTLbc8NPRm%2B9UDDf5u03yHFMsnVpBWAHpz1sImLg2X63RMhFSGDlFCaP6M554lYiIp7t2OD6Xh5QvywpIUoiBtgyXa3gp%2FruK5euVNSQRAAsA%3D"}],"max_age":604800}
nel
{"max_age":604800,"report_to":"cf-nel"}
vary
Accept-Encoding
server
cloudflare
cf-ray
624a02f10ffb4e68-FRA
content-encoding
br
usync.html
eus.rubiconproject.com/ Frame 4F9C
291 B
559 B
Document
General
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.108.50.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-50-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
4ddc003bfd0366a9c5e059509b3bac51972a8e803904b2a90b6b5c5ee7b26720

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.southbendtribune.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Mon, 28 Sep 2020 17:02:39 GMT
ETag
"4000c-123-5b062a240e9c0"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
238
Content-Type
text/html; charset=UTF-8
Date
Sat, 20 Feb 2021 17:40:13 GMT
Connection
keep-alive
Vary
Accept-Encoding
pd
eu-u.openx.net/w/1.0/ Frame 2892
668 B
723 B
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
019fb96386bd84e4a17665d2c25e0114e070985c1e6a56b513cfd67259b10ef7

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=468cd1f9-0129-4882-96a2-cc15c298c6c4|1613842810
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

vary
Accept, Accept-Encoding
set-cookie
i=468cd1f9-0129-4882-96a2-cc15c298c6c4|1613842810; Version=1; Expires=Sun, 20-Feb-2022 17:40:13 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1613842813|gekin0vNiygu; Version=1; Expires=Sun, 07-Mar-2021 17:40:13 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.202.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 20 Feb 2021 17:40:13 GMT
content-type
text/html
content-length
419
content-encoding
gzip
via
1.1 google
alt-svc
clear
showad.js
ads.pubmatic.com/AdServer/js/ Frame 737E
37 KB
14 KB
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-198.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e70f46ce29bc22961327a3240b545cf419346d8c52316f774c7a7b2685914b8e

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.southbendtribune.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PugT=1613842809; PUBMDCID=3; KRTBCOOKIE_699=22727-AABAbU7AYpMAAA_YBFDGog
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

Last-Modified
Wed, 21 Oct 2020 18:57:52 GMT
ETag
"13006b6-94f8-5b232eca8cf5e"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
13837
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=123025
Expires
Mon, 22 Feb 2021 03:50:38 GMT
Date
Sat, 20 Feb 2021 17:40:13 GMT
Connection
keep-alive
Vary
Accept-Encoding
Cookie set check.html
biddr.brealtime.com/ Frame A902
926 B
1 KB
Document
General
Full URL
https://biddr.brealtime.com/check.html
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.17.120.107 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Host
biddr.brealtime.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.southbendtribune.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

Date
Sat, 20 Feb 2021 17:40:13 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d4640c424fa5371ba25af47cca82766c61613842813; expires=Mon, 22-Mar-21 17:40:13 GMT; path=/; domain=.brealtime.com; HttpOnly; SameSite=Lax
x-amz-id-2
zLK+otkipESBbarT0a8bhlo16ZCN/UFM5DuUEENRZ7spy18q3kPJVJejXa65EihRlHU1l1/jSCA=
x-amz-request-id
22BA75567DC2B50F
Last-Modified
Tue, 08 Sep 2020 13:51:51 GMT
CF-Cache-Status
HIT
Age
3295
Expires
Sat, 20 Feb 2021 17:41:13 GMT
Cache-Control
public, max-age=60
cf-request-id
0862202ad4000023c71d994000000001
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
Server
cloudflare
CF-RAY
624a02f1586b23c7-ZRH
Content-Encoding
gzip
/
ssc-cms.33across.com/ps/ Frame 20F2
0
0
Document
General
Full URL
https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=avHmsEZx0r6ikSaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.173 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
Software
33XP003 /
Resource Hash

Request headers

:method
GET
:authority
ssc-cms.33across.com
:scheme
https
:path
/ps/?m=xch&rt=html&ru=deb&id=avHmsEZx0r6ikSaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

x-33x-status
2020008
server
33XP003
date
Sat, 20 Feb 2021 17:40:13 GMT
ixmatch.html
js-sec.indexww.com/um/ Frame BCAA
2 KB
1 KB
Document
General
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Host
js-sec.indexww.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.southbendtribune.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

Server
Apache
Last-Modified
Thu, 11 Feb 2021 16:12:45 GMT
ETag
"e20015-90b-5bb11ca420f07"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Date
Sat, 20 Feb 2021 17:40:13 GMT
Content-Length
1151
Connection
keep-alive
index.html
cdn.districtm.io/ids/ Frame 558F
0
0
Document
General
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
cdn.districtm.io
:scheme
https
:path
/ids/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.southbendtribune.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

date
Sat, 20 Feb 2021 17:40:13 GMT
set-cookie
__cfduid=d5511de814b5bf17ee412c0b59d65c0a71613842813; expires=Mon, 22-Mar-21 17:40:13 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Origin
access-control-allow-methods
GET, HEAD, POST, OPTIONS
cf-request-id
0862202ab10000cc360d280000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
624a02f11f97cc36-ZRH
async_usersync.html
acdn.adnxs.com/dmp/ Frame 0BAC
52 KB
17 KB
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid-3.27.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.13.10 /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.southbendtribune.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.southbendtribune.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.13.10
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Fri, 12 Feb 2021 05:50:00 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Sat, 20 Feb 2021 17:40:13 GMT
Age
42597
X-Served-By
cache-lga21960-LGA, cache-fra19181-FRA
X-Cache
HIT, HIT
X-Cache-Hits
3, 242827
X-Timer
S1613842814.667442,VS0,VE0
Vary
Accept-Encoding
gdpr_consent=
sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/ Frame 5C26
Redirect Chain
  • https://id5-sync.com/s/441/9.gif?puid=e_9f2ff663-d351-45c7-8758-4bbbef1b23b8&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/441/441/9/1.gif?puid=e_9f2ff663-d351-45c7-8758-4bbbef1b23b8&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/441/2/8/2.gif?puid=$UID&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fid5-sync.com%2Fc%2F441%2F2%2F8%2F2.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/441/2/8/2.gif?puid=6441404401232087858&gdpr=0&gdpr_consent=
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-ZHMOh8xJXdV2gDtTpUvZJm_2Z1SGigNjpmPyAspyqw&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F3%2F7%2F3.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26g...
  • https://id5-sync.com/c/441/3/7/3.gif?puid=b37c6031-497d-4800-8d97-293bd35ac316&gdpr=0&gdpr_consent=
  • https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOh8xJXdV2gDtTpUvZJm_2Z1SGigNjpmPyAspyqw&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F441%2F124%2F6%2F4.gif%3Fpuid%3D...
  • https://ice.360yield.com/ul_cb/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOh8xJXdV2gDtTpUvZJm_2Z1SGigNjpmPyAspyqw&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F441%2F124%2F6%2F4.gif%3Fp...
  • https://id5-sync.com/cq/441/124/6/4.gif?puid=e5573f39-3258-4835-9f7c-d45881ae881f&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
  • https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F203%2F5%2F5.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/441/203/5/5.gif?puid=b806803f-9a6a-4e47-8cfb-7ed85cb1ee7b&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/264.gif?puid=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&ttl=%%TTL%%
  • https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F10%2F3%2F7.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
  • https://id5-sync.com/c/441/10/3/7.gif?puid=6532640163108253535&gdpr=0&gdpr_consent=
  • https://sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/441/19/2/8.gif?puid=${profile_id}&gdpr=0&gdpr_consent=
0
0

us.gif
sync.go.sonobi.com/ Frame 5C26
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=sonobi
  • https://x.bidswitch.net/ul_cb/sync?ssp=sonobi
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=sonobi&bsw_param=1736acce-807e-4e73-9457-815dd0dce810&google_hm=MTczNmFjY2UtODA3ZS00ZTczLTk0NTctODE1ZGQwZGNlODEw
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEFChpNKQrKVfAmeWpRFXVAg&google_cver=1&ssp=sonobi&bsw_param=1736acce-807e-4e73-9457-815dd0dce810
  • https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=1736acce-807e-4e73-9457-815dd0dce810
49 B
509 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=1736acce-807e-4e73-9457-815dd0dce810
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
//sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=1736acce-807e-4e73-9457-815dd0dce810
date
Sat, 20 Feb 2021 17:40:13 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
us.gif
sync.go.sonobi.com/ Frame 5C26
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=e315a43aa9&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=e315a43aa9&gdpr=0&gdpr_consent=
  • https://sync.go.sonobi.com/us.gif?nw=td&nuid=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&pubid=e315a43aa9
49 B
509 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=td&nuid=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&pubid=e315a43aa9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://sync.go.sonobi.com/us.gif?nw=td&nuid=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&pubid=e315a43aa9
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
227
us.gif
sync.go.sonobi.com/ Frame 5C26
Redirect Chain
  • https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID]
  • https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=74786031-497d-4f00-8f0b-c8c096348434
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=74786031-497d-4f00-8f0b-c8c096348434
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.southbendtribune.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Sat, 20 Feb 2021 17:40:12 GMT
Server
MT3 3518 2f03077 master zrh-pixel-x25
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=74786031-497d-4f00-8f0b-c8c096348434
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sat, 20 Feb 2021 17:40:11 GMT
1x1.png
cdn.aralego.net/img/ Frame 1E7B
Redirect Chain
  • https://sync.aralego.com/idsync?
  • https://pr-bh.ybp.yahoo.com/sync/ucfunnel/56f308f4-9837-3268-bd0a-4d3a3c79d777?gdpr=0&euconsent=
  • https://sync.aralego.com/idsync?ucf_nid=dsp-AE38A6E4BB372DE1838A748E89487D9&ucf_user_id=y-N1NuXTR1lwKg5bY0hKhOqty8DGvoxmBT36v_KTM-&redirect=
  • https://cm.g.doubleclick.net/pixel?google_nid=aralego&google_hm=NTZmMzA4ZjQtOTgzNy0zMjY4LWJkMGEtNGQzYTNjNzlkNzc3&google_redir=https%3A%2F%2Fcdn.aralego.net%2Fimg%2F1x1.png
  • https://cdn.aralego.net/img/1x1.png
68 B
543 B
Image
General
Full URL
https://cdn.aralego.net/img/1x1.png
Requested by
Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/sync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:467 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Referer
https://cdn.aralego.net/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:14 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6751
content-length
68
cf-request-id
0862202e7100004e688620d000000001
last-modified
Wed, 12 Jun 2019 06:09:43 GMT
server
cloudflare
etag
"5d009727-44"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2Bpyjoj%2B5ZD7QaZEXrieZ%2F83mK5yWUFz3kDba1NmTz19xEB4Tf6NZXsQbqImKvXFejuEwoQkUoKYwr07Mu%2FKDaFF32tlMrxj2%2Feh6pY4QIYtYjXQnxDQ%2FklCGjwk%3D"}],"max_age":604800}
content-type
image/png
cache-control
max-age=14400
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
624a02f71ab84e68-FRA

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:14 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cdn.aralego.net/img/1x1.png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
232
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame 4F9C
31 KB
10 KB
Script
General
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.108.50.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-50-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
16975092f2e5a9b12bce76ab1e822fa6d29f35bab6b36671391bff732414abe9

Request headers

Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 28 Jan 2021 20:32:24 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=37745
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9309
Expires
Sun, 21 Feb 2021 04:09:18 GMT
sd
eu-u.openx.net/w/1.0/ Frame 2892
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=b37c6031-497d-4800-8d97-293bd35ac316
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=b37c6031-497d-4800-8d97-293bd35ac316
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Sat, 20 Feb 2021 17:40:12 GMT
Server
MT3 3518 2f03077 master zrh-pixel-x14
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=b37c6031-497d-4800-8d97-293bd35ac316
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sat, 20 Feb 2021 17:40:11 GMT
sd
us-u.openx.net/w/1.0/ Frame 2892
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=8zBXUvE5UwfoOQBRozNJUPJiV1boOVUC8jktVRM-
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=8zBXUvE5UwfoOQBRozNJUPJiV1boOVUC8jktVRM-
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=8zBXUvE5UwfoOQBRozNJUPJiV1boOVUC8jktVRM-
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 2892
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6532640163108253535
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6532640163108253535
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6532640163108253535
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame 2892
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=9520eea0-a8ae-7775-cc74-04fda6bff539&gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.16.108.17 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 2892
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Yjk0ZjNkNmEtNjFkOS0yOWQxLWQ5OTQtNWU0NDZjNWQzYjU5
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Yjk0ZjNkNmEtNjFkOS0yOWQxLWQ5OTQtNWU0NDZjNWQzYjU5&google_tc=
170 B
213 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Yjk0ZjNkNmEtNjFkOS0yOWQxLWQ5OTQtNWU0NDZjNWQzYjU5&google_tc=
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Yjk0ZjNkNmEtNjFkOS0yOWQxLWQ5OTQtNWU0NDZjNWQzYjU5&google_tc=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 2892
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEItPvx4QYuStxX2RAM294Hg&google_cver=1
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEItPvx4QYuStxX2RAM294Hg&google_cver=1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
OXGW/16.202.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=76f82d4b-8581-44b9-85f2-34f5ab6622df&gdpr=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
via
1.1 google
server
OXGW/16.202.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEItPvx4QYuStxX2RAM294Hg&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame 737E
8 KB
9 KB
Script
General
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
09a77fb8c09dfdc9e1071b510ead9654e148ad8d8d976a7e9af2c4614c1f8614

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:13 GMT
P3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cookie set usermatch
ssum-sec.casalemedia.com/ Frame 1608
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
  • https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
2 KB
3 KB
Document
General
Full URL
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ed0d550091911baa869cf1dd55f3c2d826ac1fd48279798248f56fc2021d785e

Request headers

Host
ssum-sec.casalemedia.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://js-sec.indexww.com/um/ixmatch.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
CMID=YDFJfUbucIfwI6OHlaCo9wAA; CMPS=5226
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://js-sec.indexww.com/um/ixmatch.html

Response headers

Server
Apache
Content-Type
text/html
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1555
Expires
Sat, 20 Feb 2021 17:40:13 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
Connection
keep-alive
Set-Cookie
CMID=YDFJfUbucIfwI6OHlaCo9wAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sun, 20 Feb 2022 17:40:13 GMT CMPS=5226;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Fri, 21 May 2021 17:40:13 GMT CMPRO=1213;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Fri, 21 May 2021 17:40:13 GMT CMRUM3=2d6031497d05a0&bf6031497d05a0&b06031497d05a00&986031497d05a00&406031497d05a0&e66031497d27600&f16031497d05a00&276031497d0b40;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sun, 20 Feb 2022 17:40:13 GMT CMST=YDFJfWAxSX0A;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sun, 21 Feb 2021 17:40:13 GMT

Redirect headers

Server
Apache
Content-Length
347
Content-Type
text/html; charset=iso-8859-1
Location
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires
Sat, 20 Feb 2021 17:40:13 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
Connection
keep-alive
Set-Cookie
CMID=YDFJfUbucIfwI6OHlaCo9wAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sun, 20 Feb 2022 17:40:13 GMT CMPS=5226;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Fri, 21 May 2021 17:40:13 GMT
bounce
ib.adnxs.com/ Frame 0BAC
Redirect Chain
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
0
818 B
Script
General
Full URL
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/dmp/async_usersync.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.241:80
AN-X-Request-Uuid
e9f8b03d-7961-4f6c-b19a-0e5319ec047a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.139:80
AN-X-Request-Uuid
4ce6a57c-1a69-4c5e-9b63-eb1eae22587e
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync.aspx
dis.criteo.com/dis/ Frame B937
43 B
284 B
Document
General
Full URL
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:method
GET
:authority
dis.criteo.com
:scheme
https
:path
/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/AdServer/js/showad.js
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

cache-control
no-cache
pragma
no-cache
content-type
image/gif
expires
Sat, 20 Feb 2021 00:00:00 GMT
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
server-processing-duration-in-ticks
1517
date
Sat, 20 Feb 2021 17:40:13 GMT
content-length
43
Cookie set Pug
image2.pubmatic.com/AdServer/ Frame FBA4
Redirect Chain
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7529919757327060848
42 B
973 B
Document
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7529919757327060848
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
image2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KRTBCOOKIE_699=22727-AABAbU7AYpMAAA_YBFDGog; KTPCACOOKIE=YES; pi=95054:2; KADUSERCOOKIE=36C03982-301C-435B-8B4D-083BF1859732; chkChromeAb67Sec=1; DPSync3=1614988800%3A201_227_226_221; SyncRTB3=1614643200%3A63%7C1614988800%3A54_7_71_88_166_55_99_78_5_161_223_22_81_176_13_3_8_204_220_21_56_222_165_189%7C1614384000%3A67_15_2%7C1615075200%3A35%7C1616371200%3A203; KRTBCOOKIE_80=16514-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&22987-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&23025-CAESEMMuZK8QEVprTgK0VZPr0Vc; KRTBCOOKIE_57=22776-6441404401232087858; KRTBCOOKIE_153=19420-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA&KRTB&22979-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA; KRTBCOOKIE_27=16735-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&16736-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23019-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23114-uid:b37c6031-497d-4800-8d97-293bd35ac316; KRTBCOOKIE_391=22924-6532640163108253535; KRTBCOOKIE_377=6810-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&22918-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&23031-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2; KRTBCOOKIE_22=14911-8546845238932743443; KRTBCOOKIE_409=22966-uB3IFrotXcNG9hq0iT7pWWak&KRTB&23212-uB3IFrotXcNG9hq0iT7pWWak; KRTBCOOKIE_1101=23040-6931402102749329547; PugT=1613842814
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Date
Sat, 20 Feb 2021 17:40:14 GMT
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
Set-Cookie
KRTBCOOKIE_336=5844-7529919757327060848; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:14 GMT; path=/ PugT=1613842814; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:14 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 21-May-2021 17:40:14 GMT; path=/
X-lat
Pug23012:0:347
Content-Length
42
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Pragma
no-cache
X-Cnection
close
Content-Type
image/gif; charset=utf-8

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7529919757327060848
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
Cookie set Pug
image2.pubmatic.com/AdServer/ Frame 41C0
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFHc29VN0FZcE1BQUFfbTdmSTNTUQ&bee_sync_partners=pm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAGsoU7AYpMAAA_m7fI3SQ
42 B
977 B
Document
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAGsoU7AYpMAAA_m7fI3SQ
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
image2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KRTBCOOKIE_699=22727-AABAbU7AYpMAAA_YBFDGog; KTPCACOOKIE=YES; pi=95054:2; KADUSERCOOKIE=36C03982-301C-435B-8B4D-083BF1859732; chkChromeAb67Sec=1; DPSync3=1614988800%3A201_227_226_221; SyncRTB3=1614643200%3A63%7C1614988800%3A54_7_71_88_166_55_99_78_5_161_223_22_81_176_13_3_8_204_220_21_56_222_165_189%7C1614384000%3A67_15_2%7C1615075200%3A35%7C1616371200%3A203; KRTBCOOKIE_80=16514-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&22987-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&23025-CAESEMMuZK8QEVprTgK0VZPr0Vc; KRTBCOOKIE_57=22776-6441404401232087858; KRTBCOOKIE_153=19420-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA&KRTB&22979-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA; KRTBCOOKIE_27=16735-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&16736-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23019-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23114-uid:b37c6031-497d-4800-8d97-293bd35ac316; KRTBCOOKIE_391=22924-6532640163108253535; KRTBCOOKIE_377=6810-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&22918-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&23031-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2; KRTBCOOKIE_22=14911-8546845238932743443; KRTBCOOKIE_409=22966-uB3IFrotXcNG9hq0iT7pWWak&KRTB&23212-uB3IFrotXcNG9hq0iT7pWWak; KRTBCOOKIE_1101=23040-6931402102749329547; PugT=1613842814
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Date
Sat, 20 Feb 2021 17:40:12 GMT
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
Set-Cookie
KRTBCOOKIE_699=22727-AAGsoU7AYpMAAA_m7fI3SQ; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:12 GMT; path=/ PugT=1613842812; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:12 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 21-May-2021 17:40:12 GMT; path=/
X-lat
Pug23037:0:288
Content-Length
42
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Pragma
no-cache
X-Cnection
close
Content-Type
image/gif; charset=utf-8

Redirect headers

Date
Sat, 20 Feb 2021 17:40:14 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAGsoU7AYpMAAA_m7fI3SQ
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
Content-Length
0
Connection
keep-alive
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame CF92
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6931402102749329547
42 B
975 B
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6931402102749329547
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KRTBCOOKIE_699=22727-AABAbU7AYpMAAA_YBFDGog; KTPCACOOKIE=YES; pi=95054:2; KADUSERCOOKIE=36C03982-301C-435B-8B4D-083BF1859732; chkChromeAb67Sec=1; DPSync3=1614988800%3A201_227_226_221; SyncRTB3=1614643200%3A63%7C1614988800%3A54_7_71_88_166_55_99_78_5_161_223_22_81_176_13_3_8_204_220_21_56_222_165_189%7C1614384000%3A67_15_2%7C1615075200%3A35%7C1616371200%3A203; KRTBCOOKIE_80=16514-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&22987-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&23025-CAESEMMuZK8QEVprTgK0VZPr0Vc; KRTBCOOKIE_57=22776-6441404401232087858; KRTBCOOKIE_153=19420-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA&KRTB&22979-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA; KRTBCOOKIE_27=16735-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&16736-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23019-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23114-uid:b37c6031-497d-4800-8d97-293bd35ac316; PugT=1613842813; KRTBCOOKIE_391=22924-6532640163108253535
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Date
Sat, 20 Feb 2021 17:40:14 GMT
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
Set-Cookie
KRTBCOOKIE_1101=23040-6931402102749329547; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:14 GMT; path=/ PugT=1613842814; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:14 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 21-May-2021 17:40:14 GMT; path=/
X-lat
Pug23024:0:321
Content-Length
42
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Pragma
no-cache
X-Cnection
close
Content-Type
image/gif; charset=utf-8

Redirect headers

Server
nginx
Date
Sat, 20 Feb 2021 17:40:13 GMT
Transfer-Encoding
chunked
Connection
keep-alive
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Set-Cookie
UserID1=6931402102749329547; Max-Age=7776000; domain=.adfarm1.adition.com; Path=/; SameSite=None; Secure
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6931402102749329547
Cookie set Pug
image2.pubmatic.com/AdServer/ Frame B4EF
Redirect Chain
  • https://green.erne.co/pubmatic/cm?
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=uB3IFrotXcNG9hq0iT7pWWak
42 B
1015 B
Document
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=uB3IFrotXcNG9hq0iT7pWWak
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
image2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KRTBCOOKIE_699=22727-AABAbU7AYpMAAA_YBFDGog; KTPCACOOKIE=YES; pi=95054:2; KADUSERCOOKIE=36C03982-301C-435B-8B4D-083BF1859732; chkChromeAb67Sec=1; DPSync3=1614988800%3A201_227_226_221; SyncRTB3=1614643200%3A63%7C1614988800%3A54_7_71_88_166_55_99_78_5_161_223_22_81_176_13_3_8_204_220_21_56_222_165_189%7C1614384000%3A67_15_2%7C1615075200%3A35%7C1616371200%3A203; KRTBCOOKIE_80=16514-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&22987-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&23025-CAESEMMuZK8QEVprTgK0VZPr0Vc; KRTBCOOKIE_57=22776-6441404401232087858; KRTBCOOKIE_153=19420-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA&KRTB&22979-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA; KRTBCOOKIE_27=16735-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&16736-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23019-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23114-uid:b37c6031-497d-4800-8d97-293bd35ac316; PugT=1613842813; KRTBCOOKIE_391=22924-6532640163108253535
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Date
Sat, 20 Feb 2021 17:40:12 GMT
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
Set-Cookie
KRTBCOOKIE_409=22966-uB3IFrotXcNG9hq0iT7pWWak&KRTB&23212-uB3IFrotXcNG9hq0iT7pWWak; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:12 GMT; path=/ PugT=1613842812; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:12 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 21-May-2021 17:40:12 GMT; path=/
X-lat
Pug23048:0:284
Content-Length
42
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Pragma
no-cache
X-Cnection
close
Content-Type
image/gif; charset=utf-8

Redirect headers

server
openresty
date
Sat, 20 Feb 2021 17:40:13 GMT
content-length
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
set-cookie
u=uB3IFrotXcNG9hq0iT7pWWak; Max-Age=63072000; Domain=.erne.co; Path=/; Secure; SameSite=None
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=uB3IFrotXcNG9hq0iT7pWWak
strict-transport-security
max-age=0; includeSubDomains;
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame 9CEF
Redirect Chain
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2548470698
  • https://sync.1rx.io/usersync/tradedesk/6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2
  • https://sync.targeting.unrulymedia.com/csync/RX-52d658b2-8768-453b-aa8a-5369803162ab-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-52d658b2-8768-453b-aa8a-5369803162ab-003
42 B
1 KB
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-52d658b2-8768-453b-aa8a-5369803162ab-003
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KTPCACOOKIE=YES; pi=95054:2; KADUSERCOOKIE=36C03982-301C-435B-8B4D-083BF1859732; chkChromeAb67Sec=1; DPSync3=1614988800%3A201_227_226_221; SyncRTB3=1614643200%3A63%7C1614988800%3A54_7_71_88_166_55_99_78_5_161_223_22_81_176_13_3_8_204_220_21_56_222_165_189%7C1614384000%3A67_15_2%7C1615075200%3A35%7C1616371200%3A203; KRTBCOOKIE_80=16514-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&22987-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&23025-CAESEMMuZK8QEVprTgK0VZPr0Vc; KRTBCOOKIE_57=22776-6441404401232087858; KRTBCOOKIE_153=19420-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA&KRTB&22979-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA; KRTBCOOKIE_27=16735-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&16736-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23019-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23114-uid:b37c6031-497d-4800-8d97-293bd35ac316; KRTBCOOKIE_391=22924-6532640163108253535; KRTBCOOKIE_377=6810-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&22918-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&23031-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2; KRTBCOOKIE_22=14911-8546845238932743443; KRTBCOOKIE_409=22966-uB3IFrotXcNG9hq0iT7pWWak&KRTB&23212-uB3IFrotXcNG9hq0iT7pWWak; KRTBCOOKIE_1101=23040-6931402102749329547; KRTBCOOKIE_1074=22956-e_fab5108b-b094-4e1e-b16e-c3eb7cc51eb1; SPugT=1613842812; KRTBCOOKIE_336=5844-7529919757327060848; KRTBCOOKIE_218=22978-YDFJfQAAAKw__zoG&KRTB&23194-YDFJfQAAAKw__zoG&KRTB&23209-YDFJfQAAAKw__zoG&KRTB&23244-YDFJfQAAAKw__zoG; KRTBCOOKIE_699=22727-AAGsoU7AYpMAAA_m7fI3SQ; KRTBCOOKIE_188=3189-745268aa-806c-4b12-bcbf-ccd9b26dc2f7-6031497e-4348; KRTBCOOKIE_466=16530-1736acce-807e-4e73-9457-815dd0dce810; PugT=1613842814
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Date
Sat, 20 Feb 2021 17:40:14 GMT
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
Set-Cookie
KRTBCOOKIE_594=17105-RX-52d658b2-8768-453b-aa8a-5369803162ab-003&KRTB&17107-RX-52d658b2-8768-453b-aa8a-5369803162ab-003; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 21-May-2021 17:40:14 GMT; path=/ PugT=1613842814; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:14 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 21-May-2021 17:40:14 GMT; path=/
X-lat
Pug23020:0:344
Content-Length
42
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Pragma
no-cache
X-Cnection
close
Content-Type
image/gif; charset=utf-8

Redirect headers

Server
Tengine
Date
Sat, 20 Feb 2021 17:40:14 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
_rxuuid=%7B%22rx_uuid%22%3A%22RX-52d658b2-8768-453b-aa8a-5369803162ab-003%22%7D; path=/; expires=Sun, 20 Feb 2022 17:40:14 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-52d658b2-8768-453b-aa8a-5369803162ab-003
ETag
RX52d658b28768453baa8a5369803162ab003
bridge
cm.adgrx.com/ Frame 0558
43 B
408 B
Document
General
Full URL
https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.231.181.122 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
Cowboy /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Host
cm.adgrx.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Date
Sat, 20 Feb 2021 17:40:13 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
server
Cowboy
X-RealServer-NX
ams-delivery-3
Cache-Control
no-cache, no-store, must-revalidate, proxy-revalidate
Pragma
no-cache
Expires
Thu, 23 Sep 2004 17:42:04 GMT
P3P
CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin
*
i.match
s.tribalfusion.com/z/ Frame 75BE
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...
43 B
558 B
Document
General
Full URL
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.12.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

:method
GET
:authority
s.tribalfusion.com
:scheme
https
:path
/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/AdServer/js/showad.js
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
ANON_ID=a3noeUM0inx9PBmUVHMB4059nhYTXc0VaFZdPc888
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

date
Sat, 20 Feb 2021 17:40:14 GMT
content-type
image/gif; charset=utf-8
content-length
43
set-cookie
__cfduid=d7b4a175e3e4fbe0a63d209886eb69f721613842814; expires=Mon, 22-Mar-21 17:40:14 GMT; path=/; domain=.tribalfusion.com; HttpOnly; SameSite=Lax ANON_ID=a2nsIHP3rT6CiAyPrWjp2WcdIAWQUGZcQX45TYwTGiRMWjDTSn5USh3eUZcE5PiMLZbBf6slwyDnwSXYJNqrowh6hNR; path=/; domain=.tribalfusion.com; expires=Fri, 21-May-2021 17:40:14 GMT; SameSite=None; Secure; ANON_ID_old=a2nsIHP3rT6CiAyPrWjp2WcdIAWQUGZcQX45TYwTGiRMWjDTSn5USh3eUZcE5PiMLZbBf6slwyDnwSXYJNqrowh6hNR; path=/; domain=.tribalfusion.com; expires=Fri, 21-May-2021 17:40:14 GMT;
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
302
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
cf-cache-status
DYNAMIC
cf-request-id
0862202c7b0000cc569c344000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
624a02f3ff4dcc56-ZRH
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date
Sat, 20 Feb 2021 17:40:14 GMT
content-type
text/html
set-cookie
__cfduid=d8af184c3a38f2545dec90d8eb8cf58d81613842813; expires=Mon, 22-Mar-21 17:40:13 GMT; path=/; domain=.tribalfusion.com; HttpOnly; SameSite=Lax ANON_ID=a3noeUM0inx9PBmUVHMB4059nhYTXc0VaFZdPc888; path=/; domain=.tribalfusion.com; expires=Fri, 21-May-2021 17:40:13 GMT; SameSite=None; Secure; ANON_ID_old=a3noeUM0inx9PBmUVHMB4059nhYTXc0VaFZdPc888; path=/; domain=.tribalfusion.com; expires=Fri, 21-May-2021 17:40:13 GMT;
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
206
x-reuse-index
83
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
location
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
cf-cache-status
DYNAMIC
cf-request-id
0862202bb30000cc56069e8000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
624a02f2bcfacc56-ZRH
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame E1A5
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%%
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=e01vBY3QMtAJ&pid=557219
1 B
667 B
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=e01vBY3QMtAJ&pid=557219
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KTPCACOOKIE=YES; pi=95054:2; KADUSERCOOKIE=36C03982-301C-435B-8B4D-083BF1859732; chkChromeAb67Sec=1; DPSync3=1614988800%3A201_227_226_221; SyncRTB3=1614643200%3A63%7C1614988800%3A54_7_71_88_166_55_99_78_5_161_223_22_81_176_13_3_8_204_220_21_56_222_165_189%7C1614384000%3A67_15_2%7C1615075200%3A35%7C1616371200%3A203; KRTBCOOKIE_80=16514-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&22987-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&23025-CAESEMMuZK8QEVprTgK0VZPr0Vc; KRTBCOOKIE_57=22776-6441404401232087858; KRTBCOOKIE_153=19420-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA&KRTB&22979-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA; KRTBCOOKIE_27=16735-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&16736-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23019-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23114-uid:b37c6031-497d-4800-8d97-293bd35ac316; KRTBCOOKIE_391=22924-6532640163108253535; KRTBCOOKIE_377=6810-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&22918-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&23031-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2; KRTBCOOKIE_22=14911-8546845238932743443; KRTBCOOKIE_409=22966-uB3IFrotXcNG9hq0iT7pWWak&KRTB&23212-uB3IFrotXcNG9hq0iT7pWWak; KRTBCOOKIE_1101=23040-6931402102749329547; KRTBCOOKIE_1074=22956-e_fab5108b-b094-4e1e-b16e-c3eb7cc51eb1; SPugT=1613842812; KRTBCOOKIE_336=5844-7529919757327060848; KRTBCOOKIE_218=22978-YDFJfQAAAKw__zoG&KRTB&23194-YDFJfQAAAKw__zoG&KRTB&23209-YDFJfQAAAKw__zoG&KRTB&23244-YDFJfQAAAKw__zoG; KRTBCOOKIE_699=22727-AAGsoU7AYpMAAA_m7fI3SQ; KRTBCOOKIE_188=3189-745268aa-806c-4b12-bcbf-ccd9b26dc2f7-6031497e-4348; KRTBCOOKIE_466=16530-1736acce-807e-4e73-9457-815dd0dce810; PugT=1613842814
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Date
Sat, 20 Feb 2021 17:40:13 GMT
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
Set-Cookie
PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 21-May-2021 17:40:13 GMT; path=/
X-lat
Pug23041:0:226
Content-Length
1
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Pragma
no-cache
X-Cnection
close
Content-Type
text/html; charset=utf-8

Redirect headers

p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server
bh-deployment-75d6d6d469-qggpm
cache-control
private, max-age=0, no-cache, no-store
expires
-1
content-language
en-US
set-cookie
V=e01vBY3QMtAJ;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Tue, 15-Feb-2022 17:40:14 GMT;Max-Age=31104000;SameSite=None
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=e01vBY3QMtAJ&pid=557219
server
Jetty(9.4.14.v20181114)
strict-transport-security
max-age=15768000
rtb-h
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame DBF5
Redirect Chain
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=e6135727-3e8a-4b77-b9ea-515aee9d0c55-tuct72acefe&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...
0
147 B
Document
General
Full URL
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=e6135727-3e8a-4b77-b9ea-515aee9d0c55-tuct72acefe&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
match.taboola.com
:scheme
https
:path
/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=e6135727-3e8a-4b77-b9ea-515aee9d0c55-tuct72acefe&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/AdServer/js/showad.js
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
t_gid=e6135727-3e8a-4b77-b9ea-515aee9d0c55-tuct72acefe
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

server
nginx
accept-ranges
bytes
date
Sat, 20 Feb 2021 17:40:14 GMT
via
1.1 varnish
x-served-by
cache-fra19148-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1613842814.163690,VS0,VE9
content-length
0

Redirect headers

server
nginx
set-cookie
t_gid=e6135727-3e8a-4b77-b9ea-515aee9d0c55-tuct72acefe;Version=1;Path=/;Domain=.taboola.com;Expires=Sun, 20-Feb-2022 17:40:14 GMT;Max-Age=31536000;Secure;SameSite=None
location
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=e6135727-3e8a-4b77-b9ea-515aee9d0c55-tuct72acefe&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges
bytes
date
Sat, 20 Feb 2021 17:40:14 GMT
via
1.1 varnish
x-served-by
cache-hhn11566-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1613842814.027704,VS0,VE62
x-vcl-time-ms
62
content-length
0
check
pixel.tapad.com/idsync/ex/receive/ Frame C083
Redirect Chain
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxODQmdGw9MTU3NjgwMA==&r=https://pixel.tapad.com/idsync/ex/receive?partner_id=PUBMATIC_RTB&partner_device_id=${PUBMATIC_UID}
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=PUBMATIC_RTB
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
95 B
165 B
Document
General
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.248.159 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Jetty(9.4.28.v20200408) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

:method
GET
:authority
pixel.tapad.com
:scheme
https
:path
/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/AdServer/js/showad.js
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
TapAd_TS=1613842815119; TapAd_DID=b0b091f3-73a2-11eb-8361-ce3d7d6b6184
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

date
Sat, 20 Feb 2021 17:40:15 GMT
strict-transport-security
max-age=31536000
content-type
image/png
content-length
95
server
Jetty(9.4.28.v20200408)
via
1.1 google
alt-svc
clear

Redirect headers

date
Sat, 20 Feb 2021 17:40:15 GMT
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
set-cookie
TapAd_TS=1613842815119;Expires=Wed, 21 Apr 2021 17:40:15 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None TapAd_DID=b0b091f3-73a2-11eb-8361-ce3d7d6b6184;Expires=Wed, 21 Apr 2021 17:40:15 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
content-length
0
server
Jetty(9.4.28.v20200408)
via
1.1 google
alt-svc
clear
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame AF0C
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:QKncBT1X1LdweO5&gdpr=0&gdpr_consent=
42 B
973 B
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:QKncBT1X1LdweO5&gdpr=0&gdpr_consent=
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=876876&p=95054&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KTPCACOOKIE=YES; pi=95054:2; KADUSERCOOKIE=36C03982-301C-435B-8B4D-083BF1859732; chkChromeAb67Sec=1; DPSync3=1614988800%3A201_227_226_221; SyncRTB3=1614643200%3A63%7C1614988800%3A54_7_71_88_166_55_99_78_5_161_223_22_81_176_13_3_8_204_220_21_56_222_165_189%7C1614384000%3A67_15_2%7C1615075200%3A35%7C1616371200%3A203; KRTBCOOKIE_80=16514-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&22987-CAESEMMuZK8QEVprTgK0VZPr0Vc&KRTB&23025-CAESEMMuZK8QEVprTgK0VZPr0Vc; KRTBCOOKIE_57=22776-6441404401232087858; KRTBCOOKIE_153=19420-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA&KRTB&22979-BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA; KRTBCOOKIE_27=16735-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&16736-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23019-uid:b37c6031-497d-4800-8d97-293bd35ac316&KRTB&23114-uid:b37c6031-497d-4800-8d97-293bd35ac316; KRTBCOOKIE_391=22924-6532640163108253535; KRTBCOOKIE_377=6810-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&22918-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2&KRTB&23031-6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2; KRTBCOOKIE_22=14911-8546845238932743443; KRTBCOOKIE_409=22966-uB3IFrotXcNG9hq0iT7pWWak&KRTB&23212-uB3IFrotXcNG9hq0iT7pWWak; KRTBCOOKIE_1101=23040-6931402102749329547; KRTBCOOKIE_1074=22956-e_fab5108b-b094-4e1e-b16e-c3eb7cc51eb1; SPugT=1613842812; KRTBCOOKIE_336=5844-7529919757327060848; KRTBCOOKIE_218=22978-YDFJfQAAAKw__zoG&KRTB&23194-YDFJfQAAAKw__zoG&KRTB&23209-YDFJfQAAAKw__zoG&KRTB&23244-YDFJfQAAAKw__zoG; KRTBCOOKIE_699=22727-AAGsoU7AYpMAAA_m7fI3SQ; KRTBCOOKIE_188=3189-745268aa-806c-4b12-bcbf-ccd9b26dc2f7-6031497e-4348; KRTBCOOKIE_466=16530-1736acce-807e-4e73-9457-815dd0dce810; PugT=1613842814
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Date
Sat, 20 Feb 2021 17:40:14 GMT
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
Set-Cookie
KRTBCOOKIE_107=1471-uid:QKncBT1X1LdweO5; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 21-May-2021 17:40:14 GMT; path=/ PugT=1613842814; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 22-Mar-2021 17:40:14 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 21-May-2021 17:40:14 GMT; path=/
X-lat
Pug23006:0:373
Content-Length
42
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Pragma
no-cache
X-Cnection
close
Content-Type
image/gif; charset=utf-8

Redirect headers

Cache-Control
no-cache, must-revalidate
Date
Sat, 20 Feb 2021 17:40:13 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:QKncBT1X1LdweO5&gdpr=0&gdpr_consent=
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Pragma
no-cache
Server
PingMatch/v2.0.30-619-g1028223#rel-ec2-master i-015d5badb48c29580@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Set-Cookie
wfivefivec=QKncBT1X1LdweO5; Domain=.w55c.net; Expires=Sun, 20-Mar-2022 17:40:14 GMT; Path=/; SameSite=None; Secure matchpubmatic=5; Domain=.w55c.net; Expires=Mon, 22-Mar-2021 17:40:14 GMT; Path=/; SameSite=None; Secure
Content-Length
0
Connection
keep-alive
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 737E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NsA5gjAcQ1uLTQg78YWXMg%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
8 KB
8 KB
Image
General
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-198.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 21 Oct 2020 18:57:29 GMT
Server
Apache/2.2.15 (CentOS)
ETag
"1300708-1f78-5b232eb4914bb"
Vary
Accept-Encoding
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
max-age=35360
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/html; charset=UTF-8
Content-Length
2654
Expires
Sun, 21 Feb 2021 03:29:33 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
mw
mwzeom.zeotap.com/ Frame 737E
95 B
596 B
Image
General
Full URL
https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&gdpr=0&gdpr_consent=&cid=36C03982-301C-435B-8B4D-083BF1859732
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:13 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
image/png
access-control-allow-origin
https://ads.pubmatic.com
access-control-allow-credentials
true
cf-ray
624a02f27c7b4e07-FRA
access-control-allow-headers
*
content-length
95
cf-request-id
0862202b8700004e07ab334000000001
info2
uipglob.semasio.net/pubmatic/1/ Frame 737E
Redirect Chain
  • https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=36C03982-301C-435B-8B4D-083BF1859732&sInitiator=external&gdpr=0&gdpr_consent=
  • https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=36C03982-301C-435B-8B4D-083BF1859732&sInitiator=external&gdpr=0&gdpr_consent=
42 B
604 B
Image
General
Full URL
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=36C03982-301C-435B-8B4D-083BF1859732&sInitiator=external&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
77.243.60.138 Aalborg, Denmark, ASN42697 (NETIC-AS, DK),
Reverse DNS
Software
/
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:11 GMT
frontend-id
15
p3p
policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
access-control-allow-origin
*
uip-response-status
Ok
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
42
routing-server-id
-1
expires
Sat, 01 Jan 2011 12:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:11 GMT
frontend-id
3
location
/pubmatic/1/info2?sType=sync&sExtCookieId=36C03982-301C-435B-8B4D-083BF1859732&sInitiator=external&gdpr=0&gdpr_consent=
p3p
policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
access-control-allow-origin
*
uip-response-status
Ok
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
0
routing-server-id
-1
expires
Sat, 01 Jan 2011 12:00:00 GMT
Artemis
aud.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=36C03982-301C-435B-8B4D-083BF1859732&gdpr=
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=36C03982-301C-435B-8B4D-083BF1859732&gdpr=&fbounce=1
  • https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=36C03982-301C-435B-8B4D-083BF1859732&addseg=31
7 B
147 B
Image
General
Full URL
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=36C03982-301C-435B-8B4D-083BF1859732&addseg=31
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.64.189.249 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:14 GMT
Connection
keep-alive
Content-Length
7
Content-Type
text/plain; charset=utf-8

Redirect headers

date
Sat, 20 Feb 2021 17:40:13 GMT
via
1.1 google
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=36C03982-301C-435B-8B4D-083BF1859732&addseg=31
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-type
text/html; charset=utf-8
alt-svc
clear
content-length
135
Pug
image2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MzZDMDM5ODItMzAxQy00MzVCLThCNEQtMDgzQkYxODU5NzMy&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
709 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-lat
Pug23008:0:429
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEMMuZK8QEVprTgK0VZPr0Vc&google_cver=1
42 B
1 KB
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEMMuZK8QEVprTgK0VZPr0Vc&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-lat
Pug23012:0:301
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEMMuZK8QEVprTgK0VZPr0Vc&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubmatic
um.simpli.fi/ Frame 737E
43 B
611 B
Image
General
Full URL
https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.253.128.183 Amsterdam, Netherlands, ASN36351 (SOFTLAYER, US),
Reverse DNS
b7.80.fd9f.ip4.static.sl-reverse.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:13 GMT
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Fri, 19 Feb 2021 17:40:13 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2
42 B
1 KB
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:14 GMT
X-lat
Pug23005:0:264
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=6c161577-e0e4-4c0c-a8ef-d7e9aa3aa3a2
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
313
Pug
simage2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=6532640163108253535
42 B
974 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=6532640163108253535
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-lat
Pug23026:0:364
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=6532640163108253535
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:b37c6031-497d-4800-8d97-293bd35ac316&gdpr=0&gdpr_consent=
42 B
1 KB
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:b37c6031-497d-4800-8d97-293bd35ac316&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-lat
Pug23001:0:572
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Date
Sat, 20 Feb 2021 17:40:12 GMT
Server
MT3 3518 2f03077 master zrh-pixel-x31
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:b37c6031-497d-4800-8d97-293bd35ac316&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sat, 20 Feb 2021 17:40:11 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6441404401232087858&gdpr=0&gdpr_consent=
42 B
973 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6441404401232087858&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-lat
Pug23028:0:757
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.251:80
AN-X-Request-Uuid
a8e44df3-db27-42c2-93eb-b17ded8cecc6
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6441404401232087858&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
SPug
image4.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=36C03982-301C-435B-8B4D-083BF1859732&redir=true&gdpr=0&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=36C03982-301C-435B-8B4D-083BF1859732&redir=true&gdpr=0&gdpr_consent=&verify=true
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-NJaiA0l1l2INTa5594MujLzM.woSCzg-&gdpr=0&gdpr_consent=
0
587 B
Image
General
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-NJaiA0l1l2INTa5594MujLzM.woSCzg-&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Date
Sat, 20 Feb 2021 17:40:12 GMT
Content-Encoding
gzip
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
Vary
Accept-Encoding
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-cache
Transfer-Encoding
chunked
Content-Type
text/plain; charset=utf-8

Redirect headers

Date
Sat, 20 Feb 2021 17:40:13 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-NJaiA0l1l2INTa5594MujLzM.woSCzg-&gdpr=0&gdpr_consent=
Connection
keep-alive
Content-Length
0
36C03982-301C-435B-8B4D-083BF1859732
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 737E
43 B
838 B
Image
General
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/36C03982-301C-435B-8B4D-083BF1859732?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:13 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=1736acce-807e-4e73-9457-815dd0dce810
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=1736acce-807e-4e73-9457-815dd0dce810
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=304d697b-9cce-4dfd-b27a-ff3b79d79051&user_group=1&ssp=pubmatic&bsw_param=1736acce-807e-4e73-9457-815dd0dce810
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1736acce-807e-4e73-9457-815dd0dce810&gdpr=&gdpr_consent=&gdpr_pd=
1 B
949 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1736acce-807e-4e73-9457-815dd0dce810&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:14 GMT
X-lat
Pug23019:0:452
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1736acce-807e-4e73-9457-815dd0dce810&gdpr=&gdpr_consent=&gdpr_pd=
date
Sat, 20 Feb 2021 17:40:14 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
Pug
image2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA
42 B
1 KB
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:12 GMT
X-lat
Pug23034:0:293
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=BLomPwazImofs3E8VLk4PQXoJjsfsyRvBbNksAEA
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8546845238932743443&gdpr=0&gdpr_consent=&us_privacy=
1 B
931 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8546845238932743443&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:14 GMT
X-lat
Pug23019:0:391
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8546845238932743443&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YDFJfQAAAKw__zoG&gdpr=0&gdpr_consent=&_test=YDFJfQAAAKw__zoG
1 B
1013 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YDFJfQAAAKw__zoG&gdpr=0&gdpr_consent=&_test=YDFJfQAAAKw__zoG
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:14 GMT
X-lat
Pug23020:0:393
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:14 GMT
via
1.1 varnish
server
Varnish
x-timer
S1613842814.059516,VS0,VE0
x-served-by
cache-hhn4048-HHN
x-cache
HIT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YDFJfQAAAKw__zoG&gdpr=0&gdpr_consent=&_test=YDFJfQAAAKw__zoG
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
Pug
image2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=745268aa-806c-4b12-bcbf-ccd9b26dc2f7-6031497e-4348&gdpr=0&gdpr_consent=
42 B
1004 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=745268aa-806c-4b12-bcbf-ccd9b26dc2f7-6031497e-4348&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-lat
Pug23041:0:292
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=745268aa-806c-4b12-bcbf-ccd9b26dc2f7-6031497e-4348&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
current
pubmatic-match.dotomi.com/match/bounce/ Frame 737E
0
104 B
Image
General
Full URL
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=36C03982-301C-435B-8B4D-083BF1859732&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:16::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:13 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
Pug
simage2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:018b8440-f673-4ce1-81f7-9e347bcd3e8e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
42 B
709 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:018b8440-f673-4ce1-81f7-9e347bcd3e8e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-lat
Pug23050:0:349
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:018b8440-f673-4ce1-81f7-9e347bcd3e8e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date
Sat, 20 Feb 2021 17:40:14 GMT
Server
Apache/2.4.41 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
Pug
simage2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=6441404401232087858
42 B
709 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=6441404401232087858
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:13 GMT
X-lat
Pug23037:0:236
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:14 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.7:80
AN-X-Request-Uuid
d4e3f2ac-3272-499a-9815-ea76b6239a8e
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=6441404401232087858
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 737E
Redirect Chain
  • https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_fab5108b-b094-4e1e-b16e-c3eb7cc51eb1
42 B
994 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_fab5108b-b094-4e1e-b16e-c3eb7cc51eb1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/AdServer/js/showad.js
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:12 GMT
X-lat
Pug23034:0:351
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_fab5108b-b094-4e1e-b16e-c3eb7cc51eb1
date
Sat, 20 Feb 2021 17:40:14 GMT
p3p
CP="This is not a P3P policy"
server
nginx
timing-allow-origin
*
content-length
0
content-language
en-US
casale
match.adsrvr.org/track/cmf/ Frame 1608
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/casale?cm_dsp_id=70&cm_user_id=YDFJfUbucIfwI6OHlaCo9wAA&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.16.108.17 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:14 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
usermatchredir
ssum-sec.casalemedia.com/ Frame 1608
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YDFJfUbucIfwI6OHlaCo9wAABL0AAAIB
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&google_gid=CAESEBQLjMYwgSiU-48j7svwid8&google_cver=1
43 B
315 B
Image
General
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&google_gid=CAESEBQLjMYwgSiU-48j7svwid8&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:14 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Sat, 20 Feb 2021 17:40:14 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:14 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&google_gid=CAESEBQLjMYwgSiU-48j7svwid8&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 1608
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YDFJfUbucIfwI6OHlaCo9wAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEC_5nAQMsuUyZDler7LNgWs&google_cver=1
43 B
1003 B
Image
General
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEC_5nAQMsuUyZDler7LNgWs&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:14 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sat, 20 Feb 2021 17:40:14 GMT

Redirect headers

pragma
no-cache
date
Sat, 20 Feb 2021 17:40:14 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEC_5nAQMsuUyZDler7LNgWs&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 1608
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&id=YDFJfUbucIfwI6OHlaCo9wAABL0AAAIB
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&id=YDFJfUbucIfwI6OHlaCo9wAABL0AAAIB&dcc=t
43 B
720 B
Image
General
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&id=YDFJfUbucIfwI6OHlaCo9wAABL0AAAIB&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.239.17.112 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Request headers

Referer
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:15 GMT
Server
Server
Vary
User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:15 GMT
Server
Server
Vary
User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&id=YDFJfUbucIfwI6OHlaCo9wAABL0AAAIB&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 1608
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=48
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=e6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=e6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348&partner_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D64...
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=e6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348&expiration=1616434814
43 B
1 KB
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=e6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348&expiration=1616434814
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:15 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sat, 20 Feb 2021 17:40:15 GMT

Redirect headers

date
Sat, 20 Feb 2021 17:40:15 GMT
via
1.1 google
server
Jetty(9.4.28.v20200408)
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=e6563c2b-2bf4-4569-a667-ba1118802239-6031497e-4348&expiration=1616434814
alt-svc
clear
content-length
0
113
match.deepintent.com/usersync/ Frame 1608
0
124 B
Image
General
Full URL
https://match.deepintent.com/usersync/113
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.236.91.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 20 Feb 2021 17:40:14 GMT
x-envoy-upstream-service-time
0
server
envoy
content-length
0
crum
dsum-sec.casalemedia.com/ Frame 1608
Redirect Chain
  • https://sync.extend.tv/r.gif?exchange=index
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=23b095e1-4f6a-4e23-9eed-51829c192c9b
43 B
1 KB
Image
General
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=23b095e1-4f6a-4e23-9eed-51829c192c9b
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:15 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sat, 20 Feb 2021 17:40:15 GMT

Redirect headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:15 GMT
Access-Control-Allow-Origin
*
Content-Type
text/html; charset=utf-8
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=23b095e1-4f6a-4e23-9eed-51829c192c9b
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
132
Expires
Tue, 29 May 1984 15:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 1608
Redirect Chain
  • https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3CIndex_user_id%3E
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=5591caa5-98f1-4063-eb623aa9
43 B
1 KB
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=5591caa5-98f1-4063-eb623aa9
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:15 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sat, 20 Feb 2021 17:40:15 GMT

Redirect headers

date
Sat, 20 Feb 2021 17:40:15 GMT
via
1.1 google
server
nginx/1.19.7
access-control-allow-origin
*
p3p
CP='This is not a P3P policy!'
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=5591caa5-98f1-4063-eb623aa9
cache-control
max-age=3600
content-type
text/html; charset=utf-8
alt-svc
clear
content-length
146
htw-pixel.gif
js-sec.indexww.com/ht/ Frame 1608
43 B
425 B
Image
General
Full URL
https://js-sec.indexww.com/ht/htw-pixel.gif?YDFJfUbucIfwI6OHlaCo9wAA%261213
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/usermatch?d=https://www.southbendtribune.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 20 Feb 2021 17:40:14 GMT
Last-Modified
Tue, 24 Jan 2017 19:36:04 GMT
Server
Apache
ETag
"902a3d-2b-546dc3a097100"
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=2049
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
43
Expires
Sat, 20 Feb 2021 18:14:23 GMT
async_usersync
ib.adnxs.com/ Frame 0BAC
0
746 B
Script
General
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/dmp/async_usersync.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 20 Feb 2021 17:40:14 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 728.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.51:80
AN-X-Request-Uuid
bbf51b1a-aa15-4f2f-b1ee-cde43bfcd7c5
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
sync.crwdcntrl.net
URL
https://sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/441/19/2/8.gif?puid=${profile_id}&gdpr=0&gdpr_consent=

Verdicts & Comments Add Verdict or Comment

176 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| dataLayer object| google_tag_manager object| TNCMS object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData function| $ function| jQuery function| originalLeave function| objectFitImages function| Cookies object| SelectorQueries object| picturefillCFG function| picturefill object| lazySizesConfig object| lazySizes function| onYouTubeIframeAPIReady object| __tnt object| obj object| eb.platform object| o object| googletag function| GetURLParameter string| testKey undefined| testValue object| userStatus object| gptAdSlots function| getWindowDimensions function| parseSizeMappings object| APS_dfp_ads object| apstag object| ggeac object| google_js_reporting_queue function| pageLoaded number| TNCMS_DotConnect_Tile object| TNCMS_Used_Ad boolean| TNCMS_PAGE_LOADED object| oReq object| aTemp string| sTemp string| regionType boolean| apstagLOADED function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing number| schurzWidth function| TNStats_Tracker object| TNTracker function| postscribe function| addPlayerData string| url object| _402 function| _402_Show object| googleToken object| googleIMState function| processGoogleTokenSync string| scriptUrl object| YT object| YTConfig function| onYTReady object| webmonitoring object| paidtasksshim object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportGELQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey string| adType function| callback undefined| nQuery number| ntvLoadStart object| ntv object| prdom object| onFocusEvents function| ntvjQueryInit function| ntvExtends function| ntvAppendStylesheet function| ntvAppendScript function| ntvArticleTracker function| ntvGetElementViewability function| ntvViewableImpressionTracker object| PostRelease object| ntvToutAds boolean| onFocus function| stick_in_parent object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome number| count object| webpackJsonpCSW function| setImmediate function| clearImmediate object| civicscience object| _taboola object| TRC object| _tblConsole undefined| msg object| _comscore function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcDOMWalker function| __trcJSONify function| __trcUnJSONify function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam number| trc_debug_level string| trc_article_id object| TRCImpl number| taboola_view_id function| udm_ object| ns_p object| COMSCORE function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| _matherq object| GoogleGcLKhOms function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| google_image_requests object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| _21bc8503-7806-41da-b650-37b6eedc566f object| ads_list object| embeds_list boolean| isPageviewSent boolean| insticatorIframeLoaded object| insticatorUserTrackingMessage object| confiant

0 Cookies

25 Console Messages

Source Level URL
Text
console-api log (Line 3)
Message:
false
console-api log URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.1477faac295a3745e4796d2263e75f11.js(Line 1)
Message:
evaluating metering
console-api log URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/metering/resources/scripts/tnt.metering.c1fd4b9015c14b57a58acdbc3ee4daca.js(Line 1)
Message:
encountered an error when setting local storage
console-api log URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.1477faac295a3745e4796d2263e75f11.js(Line 1)
Message:
checking reset date
console-api log URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.1477faac295a3745e4796d2263e75f11.js(Line 1)
Message:
access granted
console-api log URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.1477faac295a3745e4796d2263e75f11.js(Line 1)
Message:
executing granted scripts
console-api log URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/metering/resources/scripts/tnt.metering.c1fd4b9015c14b57a58acdbc3ee4daca.js(Line 1)
Message:
encountered an error when setting local storage
console-api warning URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.6edb5af3e93b0a377ec925c5f1c6ddde.js(Line 2)
Message:
jQuery.Deferred exception: $form.validate is not a function TypeError: $form.validate is not a function at HTMLDocument.<anonymous> (https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html:2842:31) at e (https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.6edb5af3e93b0a377ec925c5f1c6ddde.js:2:30005) at t (https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.6edb5af3e93b0a377ec925c5f1c6ddde.js:2:30307) undefined
console-api log URL: https://cdn.taboola.com/libtrc/impl.20210217-27-RELEASE.js(Line 3)
Message:
Server did not respond to loadRBox
console-api log URL: https://cdn.taboola.com/libtrc/impl.20210217-27-RELEASE.js(Line 3)
Message:
loadRBox failed, aborting.
console-api log URL: https://cdn.taboola.com/libtrc/impl.20210217-27-RELEASE.js(Line 3)
Message:
Invalid response from server: trc_json_response = {"trc":{}}
console-api log URL: https://bloximages.newyork1.vip.townnews.com/southbendtribune.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.1477faac295a3745e4796d2263e75f11.js(Line 1)
Message:
Init YT:
console-api warning (Line 1)
Message:
NO prebid responses1
console-api warning (Line 1)
Message:
NO prebid responses1
console-api warning (Line 1)
Message:
NO prebid responses1
console-api info URL: https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs(Line 9)
Message:
Powered by AMP ⚡ HTML – Version 2012040327000 https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
console-api info URL: https://cdn.ampproject.org/rtv/042012040327000/amp4ads-v0.mjs(Line 9)
Message:
Powered by AMP ⚡ HTML – Version 2012040327000 https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html
console-api log URL: https://d3oi8laqsvc6ey.cloudfront.net/pw.js(Line 2)
Message:
Scanner Online
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js(Line 162)
Message:
dom ready!
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js(Line 451)
Message:
topFrame: [object Object]
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js(Line 212)
Message:
params: [object URLSearchParams]
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js(Line 331)
Message:
Cookie enabled, set cookie
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js(Line 297)
Message:
session: [object Object]
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js(Line 407)
Message:
Send pageview now
console-api log URL: https://d3lcz8vpax4lo2.cloudfront.net/header-tags/136953cb-88f9-48b3-9417-8f28d8a3cf54/9e6fa088-3ce1-4007-a79c-afe1fd9fa0d8.js(Line 412)
Message:
formatedPageview: {"timestamp":"2021-02-20T17:40:06.826Z","user_data":{"session_details":{"id":"ef5b5a9f-dade-4adb-8bb0-c34c68f70511","referrer":"","campaign":{"source":null,"medium":null,"campaign":null,"term":null,"content":null}}},"embed_context":{"site":{"id":"136953cb-88f9-48b3-9417-8f28d8a3cf54","page_url":"https://www.southbendtribune.com/news/business/elkhart-payroll-company-accused-of-fraudulently-wiring-million-it-didn/article_47a83152-829f-5896-928e-0ba21367ef33.html","hostname":"www.southbendtribune.com"},"environment":{"device":"DESKTOP"}},"event_data":{"type":"load","data":{"pageview_type":"AD_ONLY","integration_type":"DFP_WITHOUT_SAFEFRAME","ads":["div-insticator-ad-4"],"embed":[],"header_code_version":"STANDARD-V_4_0_1-2021-02-20 04:00:36","test_group":"0"}}}

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

454e894052a987406f58c9202386c9c1.safeframe.googlesyndication.com
4d99f37e7c8dc25469e4f8c942572412.safeframe.googlesyndication.com
a.tribalfusion.com
aa8bde3daec928214ee0de2ce0048e90.safeframe.googlesyndication.com
aax-eu.amazon-adsystem.com
acdn.adnxs.com
ad.turn.com
ads.playground.xyz
ads.pubmatic.com
ads.yahoo.com
ads3.mthsense.com
adservice.google.com
adservice.google.de
ampcid.google.com
ampcid.google.de
ap.lijit.com
apex.go.sonobi.com
api.rlcdn.com
aud.pubmatic.com
b2c.insticator.com
bh.contextweb.com
biddr.brealtime.com
bloximages.newyork1.vip.townnews.com
bluellipse.advertserve.com
btlr.sharethrough.com
c.amazon-adsystem.com
c1.adform.net
c4981dc7ca65972f929725d0e6576531.safeframe.googlesyndication.com
cdn.ampproject.org
cdn.aralego.net
cdn.districtm.io
cdn.taboola.com
cdn4.wibbitz.com
cm.adgrx.com
cm.g.doubleclick.net
confiant-integrations.global.ssl.fastly.net
content.readefined.com
cookiex.ngd.yahoo.com
cs.emxdgt.com
d2na2p72vtqyok.cloudfront.net
d2s8wlbatk24s7.cloudfront.net
d2zqfs55y95cft.cloudfront.net
d3lcz8vpax4lo2.cloudfront.net
d3oi8laqsvc6ey.cloudfront.net
d5p.de17a.com
df80k0z3fi8zg.cloudfront.net
dh014lg6uwepv.cloudfront.net
dis.criteo.com
dmp.brand-display.com
dmx.districtm.io
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
edfb28179cb35161b9812e7370c51d1f.safeframe.googlesyndication.com
eu-u.openx.net
eus.rubiconproject.com
event.insticator.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g2.gumgum.com
geoip.insticator.com
green.erne.co
hb.aralego.com
hb.emxdgt.com
hbopenbid.pubmatic.com
hooks.readefined.com
htlb.casalemedia.com
ib.adnxs.com
ice.360yield.com
id.rlcdn.com
id5-sync.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
includemodal.com
insticator-d.openx.net
jadserve.postrelease.com
js-sec.indexww.com
js.matheranalytics.com
loadm.exelator.com
match.adsby.bidtheatre.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
match.taboola.com
mwzeom.zeotap.com
os4m-d.openx.net
pagead2.googlesyndication.com
pixel-eu.rubiconproject.com
pixel-sync.sitescout.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
pm.w55c.net
pool.admedo.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
pubmatic-match.dotomi.com
rtb-csync.smartadserver.com
rtb.gumgum.com
s.amazon-adsystem.com
s.ntv.io
s.tribalfusion.com
sb.scorecardresearch.com
secure.adnxs.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
ssc-cms.33across.com
ssc.33across.com
ssum-sec.casalemedia.com
stats.g.doubleclick.net
storage.googleapis.com
survey.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.aralego.com
sync.crwdcntrl.net
sync.extend.tv
sync.go.sonobi.com
sync.mathtag.com
sync.targeting.unrulymedia.com
tag.1rx.io
token.rubiconproject.com
tpc.googlesyndication.com
traxex.gannettdigital.com
trc-events.taboola.com
trc.taboola.com
u.openx.net
uipglob.semasio.net
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
visitor.fiftyt.com
www.civicscience.com
www.gannett-cdn.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.southbendtribune.com
www.youtube.com
x.bidswitch.net
x.yieldlift.com
sync.crwdcntrl.net
104.108.50.124
104.16.68.69
104.17.120.107
104.18.12.5
104.18.130.43
104.215.88.166
107.178.250.234
108.129.8.178
13.32.24.29
136.144.59.88
141.226.228.48
142.250.186.162
142.250.74.194
151.101.113.194
151.101.114.49
151.101.13.108
151.101.13.44
151.101.14.62
159.253.128.183
159.65.197.210
162.210.196.208
173.231.181.122
178.162.133.149
178.162.133.150
178.250.0.163
18.156.0.31
18.195.155.181
18.196.104.43
18.198.115.155
18.198.126.47
18.211.21.136
184.25.115.49
184.30.20.198
184.30.20.241
184.30.21.59
185.29.133.52
185.33.221.50
185.33.221.53
185.64.189.112
185.64.189.249
185.64.190.78
185.64.190.80
185.64.190.81
185.86.139.114
192.104.183.109
192.96.200.41
198.148.27.140
199.10.29.123
199.232.137.44
2001:678:cb4:bbbb::11
208.100.17.173
213.155.156.165
213.19.147.150
213.19.147.210
23.37.38.181
2600:9000:206f:4c00:f:c7b3:ce40:21
2600:9000:20d7:e00:1c:386f:ec80:21
2600:9000:20d7:e200:10:3422:3f00:21
2600:9000:211e:2600:d:77c3:2dc0:21
2600:9000:211e:600:5:ee0e:9e80:21
2600:9000:211e:8800:1a:5302:20c0:21
2606:4700:10::ac43:db6
2606:4700:20::681a:467
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1288:110:c305::8000
2a00:1288:80:800::7001
2a00:1450:4001:800::2001
2a00:1450:4001:800::200e
2a00:1450:4001:801::2002
2a00:1450:4001:801::2008
2a00:1450:4001:801::200e
2a00:1450:4001:803::200e
2a00:1450:4001:808::2002
2a00:1450:4001:808::200e
2a00:1450:4001:810::2003
2a00:1450:4001:811::2002
2a00:1450:4001:812::2001
2a00:1450:4001:812::2002
2a00:1450:4001:812::200a
2a00:1450:4001:813::2010
2a00:1450:4001:827::2001
2a00:1450:4001:827::2003
2a00:1450:4001:827::200e
2a00:1450:4001:828::2010
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::2004
2a00:1450:4001:82a::200a
2a00:1450:4001:82a::2011
2a00:1450:400c:c07::9a
2a00:1450:400c:c07::9b
2a02:fa8:8806:16::1400
3.127.88.255
3.130.148.110
34.120.207.148
34.98.107.212
34.98.64.218
35.201.96.126
35.210.53.219
35.227.248.159
35.241.40.233
35.244.207.62
37.157.6.252
51.75.146.200
52.16.108.17
52.200.180.114
52.215.8.160
52.4.152.106
52.54.243.67
52.57.230.211
52.58.167.129
52.8.46.140
52.95.124.165
54.236.220.178
54.236.91.78
54.239.17.112
54.81.50.0
65.9.24.128
65.9.91.133
66.155.71.149
69.173.144.138
69.173.144.139
69.173.144.143
72.251.249.14
77.243.60.138
85.114.159.118
87.98.242.60
00942e0cdc43e061476ed7e78e12bfe1f5e6d36b5ea4f36515a9766b27b07984
019fb96386bd84e4a17665d2c25e0114e070985c1e6a56b513cfd67259b10ef7
01ac884ecbe6cf1fe700eb7ea09a11c584ff1c4e0d69bc06c558b3bddb74f8d6
0207e3b213cecb8b4704fdfb5660443f6c2e89b7150ddf3bd2f286dfe24a283f
022c469c5d34fbf729b08680fef89c0e1171ea21e4f665c8032b5e77c34d5aa0
0230e8c67f568c29bfa2d9756f6e9f79ca6a375d99cbeb54bf09c35fb9e525c4
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fb0b3354a4f71ddcd06b075b64d0e51f38496ca5e37e303ab7ba0c44b3f984
0785141e6461918363176bb595c118997a66d51af8338db5999308cd593cfebd
078707fe31618a1d7ed83d8ec471960cfcfce9c38717c6da3998d24adecd740d
09a77fb8c09dfdc9e1071b510ead9654e148ad8d8d976a7e9af2c4614c1f8614
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bf918e95765cdd24965e6bed8f1a9ad00972f687334b56455fae1f5c90935a6
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0cc7088b335b30f7b1fa0903bc8aa143b11cb8408032d62d28d5ab768cc68c88
0d1d19881d1527477a90c59dac5ac3a51acf2d8f7894e41cac9fce9c316b1226
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0e78d0cfae1b0857bfab2d67dd19daac2aa23e6bebea11f2c10cee911be91e18
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
0f45ec3c67a10161c32f91c74d3fd42bfa409eb45d07ce81de837b45a2f5d622
1140250a8cba9bc945f55438314cb094817f9fd8c80a0d37c7f3acd50335cd0b
1143bb5ae891056f59482184346b0fe47d8e95c9e0f159f023bf0f95ec45222d
125898ed8c69e133e70ecdfd61e0aff857c03e441bdabb983ec3c5435ab6b926
130eab0b79272570e565d77bb286b5755b9aae8f33efe8af7a2689bf8eabb859
139d766485744bb7720e1a2d7b6bc03230fb87cb88c7f2c8fcab180d8875a221
1577e5f265357b01ec43709052640c1db82ea2f39c08474e8b8a1f3bdf910ba4
158e7c54ad9af075fbe586ad9dad5570e5172992c7b3e36a4f5226992a0cf4e5
16866952047175703f35c9442249205b4e18118ab9ebc311eb1fd22681946a8d
16975092f2e5a9b12bce76ab1e822fa6d29f35bab6b36671391bff732414abe9
1826b7680604376f0aac7e5c23e7ba550c3855f9b507a7bfca7391d1d123861f
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
18e0375034d708bbd07a006a0bce3e4c5ce9aecc05952f0c4ecb05117a29cb54
1b2b0ff251ace3099e3d51a387fe55a16b741832a930a21c0d0b77409e087758
1beb0c48c582686f60797d006267d72ee06ff4cc72c2216ba1fb37f87e4f78e7
1cac6c21ae0b04736e4eee03cd0fa9c18fa20f31d6b703531d1c8f5e0f3baebb
1d22ff2db56f5753470cd48729c733aa38ef15705c62f028812cdd3c51e640a4
1d584af3d0a8ad98207995400856e5e8c608551e080e252ed413e82c19ffd04f
1daab0f66666bc3a1d05d70de979a80680d985cc924e233fab61eef2d03bafe2
1ef740db793a937f6f4368858e143840f00d623232908a29950b19250ddc25c6
20f1cd8f3a76ab0f2ec4de8c77345c65e155d67beeb6b6c6eb1aba3d8775a6ca
22a4e1894d46aa4685c6affb16de0dbc266a8371cbd2ad542b7948484a92a938
22ddb28c8ce1b967dfae532a43fa4cb4ca658bcf24d83f8310f0f61ef2a23acd
2416db86422d247adfa77efe0c6ecfb95b637707044bac095b9bb53c86fbe043
255f18d0a6b07ae588ce53e5ccf75f3db6fff5ab2b418cd110391263376f0b43
26efda059c12e94e3905f155438a6a8812d734bcafd8e2b7bd17a412b002caa1
278eb320f671875791c76b0183901d055d6806277bc0c15369d6d97ae99b17b3
2791b9d3fb2ef16454735dbba6ac95b0ebc83cd42685451c94c369d7f815d4eb
295a264be79dd8589a145fd75891c349ecd49565ca551e4cd7c276c1ce8f2343
2966d2244bc6b8f2421d91abf5f6015b15273302999fb79d911306a0ee89e3e4
29f98646ab2ec9c6d0789b495f254869d56731d6692c673c9f91b3f6746d6399
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2fdbf10bb59053ad07aff10c7f1dac0a30848a3dca681b25e88b310ea5f96a56
3171df631846e0ba4065e4bcdf3dbdfe8271f1e044842b1af9f0116b4da78409
324e02d24f001792f4a75a157af2f5ececa6f0208ce0cbdd8809ad48a3e537c5
32f7a508897772600d78e7981a7509262a77379dc65969eb5099bbd211cf96cc
33779495e1de2a932e44751cfe4a114dee09a81b2987863b38a334821264646c
34b44c1dd05445bbbb440006850905d1b77026ae97e380d7c0d902f6d8b42f1e
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
38ad6752ce36169b2e8631b8b985e80282f9104ac1953fb06bfd67f79757cf93
39d082a23f97acb018f116df42b520931c365c526354e5ddaf6f571ceb0d6541
39d53a5ff9d96f40e74b5613e1bf6f6b4ccea46da948d4450d5eb95e612424ae
3a195f4603b4092d6c65a908039abc287fc010c794122639efc30dc3a925f103
3b897fd6e5af85ce6c3463d00b84b49056280b7e41375e7d132c5476e8d4a8e8
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
40f94d4bff7ccb6896e68d0b94d486b89aa3f7a46bc753a120fab954e636a573
433456e338fa091aca5d48e42618ed1a5d093927b76e4cf5c3f0e589811c7fc3
455be7fcec13cc2b2da508725109f873e05887cb138420220bfd3347ea83a80e
47c408e0c286e6ebbdae1ed851d3e73cf15b498e99e636b97007254f6f0f660f
487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
4db6732268b3d9330df1068351b18e2fd1c1c6da87b5953259b022a19ddfe7a5
4ddc003bfd0366a9c5e059509b3bac51972a8e803904b2a90b6b5c5ee7b26720
4de30c6701fd2ac897699f43c249b4098dcb85a06d2eda5451cd204e3033c9c1
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
5018230bc803da921c5e52b4c9e13973754ca8819e302dfe47320decd606a335
503155015069040e25519638bb203658086931fdf677eeedf3b099ed4ed424a3
504e827f6fee802e5eeb50d33b085554be09b78cf65e017491df06d84f7f7a75
5148b0b5c615002df64486de2b79e03fff1b34d9e9833fd30074cd42980f0442
51e52fb8e215c4a19cf2e31d4916ef72152e5b03f1a83c8c8493945664bc055e
560357e94ad4e3f3e2199cdecaaf8d339f35d97ec03de8b875eef2bbd80b43fb
572c0831343591911ee6b615e7eee7d8cde9e4443b446ef2e4caf7e0a4b5d753
579527bf4fbad50c8c68cd1c6ba80617166db5308609ace41719395a6d6fa1e5
5a65fab80371f3ad4c16be0cf8ae8d6542553bb33564b80748ebca97cb615d08
5b915e51afd63806bc0d4dd60b6c67e6afb6e0186805db493bb359bc8ee079d9
5c5e2a40da7134899428805cd2c7be46cd4c25404417dc4ed7075fe944a65b04
5cd1c9251fb27cc4b163855c9ce76478a5fa8c2b96e9324ef24fa30e4ec82523
5f8074a11d8d589151ee508aeb0245cc63374ab3c7a354462fb4143e5dd007bc
605311e1f4f120e6ad09cb144a9d0f52df7a8c913ee252fa865ceee7b17d3af1
61073828987811f51966afee5bba4346e912c3be9363e56ded7b003174dcf8ba
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
61e7ba658627df0663ea61fb8c5448caeea364be823a14e50f7152fc1854880f
638564faeb7641243100f0e20ce7bb0f7f969bdf2dc8cc06c5c1c3dfe21bf2ab
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
67c4b15e2700db5a2b5b863230fefa9e7a821f5b0cccf8c877896d512c0d5a83
6902020d783174b4f8389e2eac539a441348f368971da0fd7cadd64bece2b7d4
69f63acb505c4500095445a0cfe9dd69d76e49a9c136084cb582822f5042c95b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6de3d7d996346abb1165d465d94cea880358285fe90decf52d020a24bf75a986
6e6c02cecdf5cb7b5db7cbf455c81c05828f2f801dd585ffdfa9d4cc90e9be1a
714db6fa0eed72832d9a2ac312cf6f78fc51cfdced47f166816b9e6bc90e159a
7243503d1dc0162827d84a0d2b4207d2ff4a5a773afef645434e5cdc852995ae
72df55b97acfdeeea6e5c0fc4781d5b8be62bba01db82b6ee5cbd201828b4e63
731772885df2d8f253555edc22af58b57d3e869d5341a74b5542470c73a89515
739b8c85a7fc66c5641f1849342de96a73282d51607ad717c257721a7d1c16d2
744ff524d1ce233b0d7f09c86d6ef081fd162cd6187c8cc9df59af32f26d6081
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
750b5102a5e597808ee5921f5bd206a4c64fd3e94f0400564c338e629428e634
75259e6f17039b8c1604db8f42ac5273fb7c758fae0be047ff59843d600c3f45
7623d5c146b5fc766be70e2a709128df7c53c59741d225d4d76cd33bef5cca7f
78ab2b374f16c7b659894ba057e44422eb7b32d6b489e57c38dce0878c59fcd5
7a0eaf21fe4084cc7105e771f57731abe41a4d647a4879dea141885fcc3096b2
7cc2c8a7bd96173ee2a862c122630ab8d45ad0676ad2ad60fc55307763782230
7e18bafd1b8439527a37845ee66b6ccaba263e419de517da66db2b011646b7c5
7ec48a60849c066e9da617d0db011a6b4d70f743d6295cabdf1c38e5e4de5fe7
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8416f8febc369c76d3fc82e78d0c49c84bf1dd1904b73cee557fccdbbb5b9005
845b498b0ccf66d0108b13e2eb10258dea7f8dbd5ddda4c0b6f14f57d03187f9
84d6b5189fa1b48da019723ff855f03e04cff06518179e3b0cdd5939786a67b4
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
853ea69e5f400c3b2aadf32ec9f1f100a1e95a53e8b828d78035ee39f960389c
85a39b2febc8f8dc2a7ee1e3c4e8a23bcbe10f8250614d32efdd4b4d4bd40df8
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202
86c555f09417120aabf0770704086130d11a779aea23384431accf628fd29dfc
873aed697d352242a06cc0e1961d2503173d4cbe93713671731d6b8928961745
87eeba2697ad5eb2b03000df8a4f9bf52e54b665a09afb76d568eed20867da52
87f1df7cbadc9df5fdf4257e08c09a28822586ea51f47667ea75865d8723e2c7
88f2461b0f7239c483efd36b6921359dbcb0517bc5247b71fd2d1e613e4e7dc9
89d8b3dc14a167839ceafebe6d54e157b7b9580c62b08b12b684209480939eef
8a1a36d6c054ca80ca5c4af390a0d2dd6eb2baa03db7553e1016d3f6a5af3117
8bff9ec3a2c218db516f668f50f0b70958136d28892dc840bc0544a20ef7d61b
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e6809f0262845e28fe19045e7d7e825f2bae06f76f05c9765f3ac6cbe1b6680
8e6e9ff80a703a7ae6c18d6e32cf1a82120b4b924e12eb48a4a2c51c07f55d04
8f37f7a6e8844b8e059ff5d8525c22db03649fcba4db679f0122a9044b29a9b5
8f4e1ff811b06f7cd65cb73986f3562b03453e62cf2778918c413387d726cc34
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
8fa099e7fad882aba1d1b90f0b9e47a683dbe6fa19560fc38f621729f6979284
9180a94ecd3d5f93f0fb9fcd95a68ec3a9e1decce55694bfb9e5ce6281bdd672
9205bbda33f2a8b396c31ca48b22eb8420772716f50eb8339c00e8bb5c7e1826
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
93eac8b1fb14d0863561633dfdf563013c023393aabfb122e3be7256629d9235
94107238a1097b66d59ded9c22a26e793aaa854e8bd4f555e704aa23acb6b959
94afb4609cd5d95128057b67ee0ef36f867bacc074b6e116d874ed8b0852b73f
952f616c1e03c8671b9640dc4ca7f7f79b4d7e7d279b02b3aae7eb604b20bce5
984bca55409990098cf74adc47ed650c3d22c68900739950bd14c04c9d45f8f7
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9bb8d1b92dbec099db60ce92f7a613d40b8c7cfcca8e4308a904785f8a4d7044
9c2670ce253c1d2e8b774fe6f6f95725ad85344a1adb2efdbc6f3873b3d17c49
9cbc99185b3da4183480aa2f2493f0e2d069fb3eeb4bff772fcd7f20ebb37378
9e44c7950e21714a4b15ef8ba7c600452f1ec8ace7f1a9a0f3d517aa134f6e64
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a06af446be30cdc4a1b9c4481b813722163853b764fe4f1dcff1468662edaddd
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a3b1a1f928c73e61c1e55b89ceabfddb5ea31ef247373a944c4e56004758b220
a44fbe0106cd7084f57a8fe5bc47c2d963a2b3d6af30b4af9b050aee19d02025
a533e6ac10f159c258a7737b2a63378e910622fcc61e6c90be14d6d95328fb64
a63c2fd0ea62cdf1d313e9c71775114fcdee3fa647dc7a7c2e3f2944378d5719
a9864feca56ca49a1250b88dae34addab3fe6389f51deb995ef7bd89772324d9
aae3c2f6e8b0695dc15e3db510f848bb210dff8883c76e9e26fb4a983ddea48c
ae35469a2de645d561d555105d21f075e0469c83a7bd02ebc9547d4d5b616f73
ae8cbb5a571c9cc66da64cf7e32b9d1d74cc1a4f98b89fea7a8c23798fd6e901
b05a333852694029e02bb3f8a195b4eb6dffeed831fd2468d3e6c11f5a421407
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b286d85db3ea459f2c6ae5d83faddcb6870d52dffc5acab28d0fa229fea9a92a
b2b95d6c1d88536f7f76843a3f9774ada1b2187e9c633b49a1546e508a21b389
b4a9815e6597f872af26e1ac2bd51654f62ef8fcd2faf4b299f56cacb49bdf76
b4ab0c9d469f5fc9747b8f7433e38ebcc71a9bde85103b9ed30606d37bdbc112
b7fbd0c1297c9d16c59a0400b9412bc4569008e75df4025d673be007f5205f61
b8798d9fb74423ed28687c00f93253c94650461ff8bd5b2fc894ee832548017f
b8b5d010122cf6813861787f82cd5d3cfa18406f94d05f86328011aa8a702f59
b8ce447517dc452915a85b732b245f19bad8e41edb6bb227732ba3ed488a8e7b
b8f66dd521fbaaf876e78b37cf6fb0b1805df060ecaef84560ec366dba1c0508
b8fc8be3027f8bc886e240a13148d9f86a50b22cdb451eb5be318775fcb507be
b90bddaa859eeeff46ee20815774c407611aeb85de431d919cb8e50f18a4d693
b9a06c2d62c73e9b8ee5272b190044182a64e7369a80b1d1fded8224a5c376bd
b9e67b8aa737ee25d9afa29a6d7ffb395d2390167df4ac9c8e22c23bd372f30d
ba1da8deff23f3a0212b9e91ce7f084fde88ffb761338ac767ac3aa11a43b1a1
ba8907ca7a1f277e5e95eb15afdd77b474d669fd00105d9643068640ba629269
bc40838a707dba656095bdce002939c726b0fe7de618b613ff3a29a39aef0938
bc66916ab132e6b401020dbf1a67e7057d8bf474e0fedfad0710524a446f3ed3
c00f7beae6e8e2b86a5eee72aa751ad68dac22523e4f4970f428c6865242dace
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c312c8dcff723c5dcea1f1fc9cc0de63d9c7f29783cc9a0a4a1239c7619b5c7e
c5f9661d37f0d356f449c558e3b964ce802d6e90c663e2810393acbf1c055cab
c7919f3da91c12d38109af53dad27cebf1bd7a3489ff07adf1b7ad772abe7a01
c7b6c1499f2c9d6d0cafcb36fcb48f1ae1ffc94881e0d2ef24204c4bb6e31dd0
c7c4e85fab99165f7d8a912f21ae8d691b6a96049780d96e174e6394e09384ca
c9e1914b93c97bfb84326dabb74ab7a17c63706f8a62637fe281eedae6b50653
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb1dee846a3020eb050cf43ff25a9a468352cd2c81998a9ff585a5bfd6fc4d9e
cda248969ce5833e845a9668f595488b827e5f3cbde69ac3170fa18a8f1b7fac
ceb88b38d41017c53b6515afdfea327647a08a1dca59dda29230f55b102f018f
ceca9943857f461cb27f5ba62119d4bba42ad7dec2d04d0cd7ae945df5ef182b
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d1aa57ca9dcb025377ed43ba7e7493650315a9853e0f7cb9cff693d4055a59e6
d2a2476bbf2625cd8bda438b8b79933328f519e098f6e4aa1f6a692ef207c66c
d2d1cf462daf535c71bc7ad96b7d2c775468299e7ad18a286d73376d3ac7f7f0
d4cc2c709011178c06e10f7c74ba463f3e4df26d12c2b11809287f6a9a352f50
d765650b71b36476c850d4e745dbc6bc55bb8b3964707277147c33e26d42aef7
d8753718082b7690c2605a7ea950aeceb572ef725f0ae7b347d19d5c41c6e24d
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
daf153362023b9fe43ea16f591fcb28b5688dc589a3b85c03cba44ede35aa479
dc6fb48a957f91408d61d92dca66d379f662867ae5361977dd7d11db35081837
dce41d8f83bbbd8af7eb7e423c8e4266323a962c66ed3a3fde0db364620549dd
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e1566e53067daab167818d04dfa49eec6f3014f47ebdb99665e0adf041c50d38
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3bf7336d520f93c9c71e200ec5beffd6c3c0b1fef61e13c79e8b79e0ecb3c69
e642c0ca1e51184fce51d97e3dbccb9a9fa3c07b989a0f5a6265d3055c1cffbc
e649cc348287d336e60aad999614efb990f435d63577fecb81ad229c01a78497
e70f46ce29bc22961327a3240b545cf419346d8c52316f774c7a7b2685914b8e
e95b089c0e2dd9e9d55f282cf56414d1cb1be179a6265291808c0bb97ceec089
e9fe32bcbb33e6cf2310d1764a3b0be1ef585df28f5816ad12f30b84f4951840
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
ead4ac78592cb0600d61fa1be3f49e794af59972524204e9ab4daadf62fb7dbd
eb19bdbb8b9d5e43ed2b6c6ca6090d31767a6c7ec0b47ddf49317c450f826624
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
ed0d550091911baa869cf1dd55f3c2d826ac1fd48279798248f56fc2021d785e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef3b2092c6bd1a3a6855b7a3a0d67951f0b7cd1678bbcfe563226bfe8a2b9126
ef787f20e35b5b6a5c86e4089d1aa889756293bca5dc1c4af8605693ecdb1c76
f100e72604253769ec1c7e9ff64748c553852df5900e01bc47acaa5554396147
f14446348a58ad5e1fed1679e5a35087773bbee64cc3a15f6a0bddcd4f330770
f199a20f1fee7dec152b3591272f9715b536ed88b4c36194488fd5a734caf707
f402b2d75ac54e1c369d34b97efcedb68aa084b039ab91b85ad70ea53ebb5a3a
f61e5cd4ff71adff6250385f2915904e1e0401bb40af334eb03a1e5adaea0456
f95fe1c0376aa720a01267e70fb42a259d610fa9fa66f78e7fc629f9bd835c43
f97dd4acde48a52d05105ad2cb9baef7693ef320c525bc09365fa173606aa332
fb73d5d93057e64e297129d2873fdd0fb83ea5dea63bf77cd87e9041af59dbc7
fc168c638e5100e78d92f788ab0e1119353fb2cff24ccbbabd5fced1b9af4b8b
fc4025d062170e1dcd7eddd74780c16516ef22dcb32ab0dabc98b39d6bc971de
fd43c41dc23b54388328c3e0833aedddaac3ae7babcc6d94d405d1f9aebb6b8d
ffa8814637fab7a454e06a6403a650615c04044d4f881b04ffdfcdc1395d98da