www.mercurynews.com Open in urlscan Pro
192.0.66.2 Public Scan

ec2-52-6-88-177.compute-1.amazonaws.com

Software

- /

Resource Hash

08bf23726e257fa1b711456549e75c7950a342d4463f0c5142d8bfe8e78eb8b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:35:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
age: 223
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 44683
x-xss-protection: 1; mode=block
last-modified: Wed, 13 Dec 2023 03:34:06 GMT
server: -
etag: 33e88afc2fb02063476a3ec7b3a3f6a1
content-type: text/javascript; charset=utf-8
cache-control: public, no-cache="Set-Cookie", max-age=600
x-robots-tag: noindex, nofollow
x-amz-cf-id: SCF0-XSPcApSS9l1CvFOsjys3vrxhlnLeJmxPBEG1cPrH4HNF3IYZA==
expires: Wed, 13 Dec 2023 03:45:26 GMT

GET
H2 200 / Show response
www.mercurynews.com/_static/ 52 KB
18 KB 70ms
67ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/_static/??/wp-content/plugins/dfm-ad-mods/static/js/hhsl-check.min.js,/wp-content/plugins/mng-digisubs/static/mng-digisubs.articleShare.bundle.js?m=1702422421j

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e3e41078c31ca6ba9dad6c6cc59668292591a89d2744d302a2c50aca4e6a84f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Tue, 12 Dec 2023 23:07:01 GMT
server: nginx
x-rq: mia2 85 187 443
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 mn-logo.svg
www.mercurynews.com/wp-content/uploads/2020/09/ 12 KB
12 KB 70ms
67ms Image
image/svg+xml 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mercurynews.com/wp-content/uploads/2020/09/mn-logo.svg

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
strict-transport-security: max-age=31536000;includeSubdomains
x-rq: mia2 80 130 443
last-modified: Wed, 23 Sep 2020 17:38:16 GMT
server: nginx
etag: "497950346404e2d1"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 12014

GET
H2 200 /
secure.gravatar.com/avatar/ 1 KB
2 KB 108ms
34ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/?s=85&d=mm&r=g
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 71e1a06d13bea786011fa2c23f050fd7f089132058147df71e55e24436af739e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc: HIT mia 1
date: Wed, 13 Dec 2023 03:39:09 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="none.png"
accept-ranges: bytes
link: <https://gravatar.com/avatar/?s=85&d=mm&r=g>; rel="canonical"
content-length: 1374
alt-svc: h3=":443"; ma=86400
expires: Wed, 13 Dec 2023 03:44:09 GMT

GET
H2 200 index.js Show response
tags.remixd.com/player/v5/ 34 KB
10 KB 232ms
63ms Script
text/javascript 13.225.214.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.214.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-63.ewr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:38:47 GMT
content-encoding: gzip
via: 1.1 a0baca8f5dcda9f46c3f17957eeb39aa.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
age: 22
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 10041
last-modified: Tue, 31 Oct 2023 15:34:26 GMT
server: AmazonS3
etag: "57b6f8ad4125903b7e06bb427c232d10"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public,max-age=1800
accept-ranges: bytes
x-amz-cf-id: SWy1MGwK4v6bCJsYK_3NBeu6s9icOThPCRNdl8LwZUa0tUZ161NnpA==

GET
H2 200 Trust-Logo-Horizontal.svg
www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/ 7 KB
3 KB 66ms
66ms Image
image/svg+xml 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/Trust-Logo-Horizontal.svg

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Mon, 05 Dec 2022 16:32:50 GMT
server: nginx
x-rq: mia2 85 188 443
etag: W/"638e1d32-1ab8"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=31536000

GET
H2 200 banglogo_small.png
www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/ 15 KB
15 KB 33ms
32ms Image
image/png 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/banglogo_small.png

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

75e752bf99299219069a5af90f61408be1ab85af71df9aea097bc70e9075c122

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
strict-transport-security: max-age=31536000;includeSubdomains
x-rq: mia2 85 188 443
last-modified: Mon, 05 Dec 2022 16:32:51 GMT
server: nginx
etag: "638e1d33-3b7b"
x-cache: HIT
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 15227

GET
H2 200 / Show response
www.mercurynews.com/_static/ 197 KB
58 KB 33ms
33ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/_static/??-eJyVkNFuAkEIRX+oI2ti0/jQ9FvWXdxhZWAyMDb69Z2t9cG0mvoEgXvgAnzmMKg4ikPmOpEYJJlCdIbeDN1gJPNrLSQdbZVIVrO9wB/sjlVT2GsJue6YLGIxyNomzJf4FGjYlyEu6CW7B+eorrInZjiijFog0+C14FJ6ZPc3yP35ZHTGmytJBq4j2uLk+x0/4tbKyqeFbxos/h+o4IRN23u7tVRxSvjkrofyqHq4mv9I7+u3br3tXrvNZv4CODO47A==

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7edb3772c3a8b84c751b357add970a5bd70d1c86a22a27e266c0bacdf3186586

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Wed, 06 Dec 2023 23:24:04 GMT
server: nginx
x-rq: mia2 85 187 443
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 i18n.min.js Show response
www.mercurynews.com/wp-includes/js/dist/ 9 KB
4 KB 33ms
31ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/wp-includes/js/dist/i18n.min.js?ver=7701b0c3857f914212ef

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

698e93fe491cc7bbf07a470579a33dbd0db53c19142b7be41ebfd39a23aef11f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Wed, 06 Dec 2023 23:24:04 GMT
server: nginx
x-rq: mia2 85 187 443
etag: W/"65710294-24e5"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 loader.js Show response
www.mercurynews.com/wp-content/mu-plugins/wp-parsely-3.12/build/ 3 KB
2 KB 32ms
31ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/wp-content/mu-plugins/wp-parsely-3.12/build/loader.js?m=1702416325g

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

57298ae9c2168c3f86b4f4e67b9b6a222ce706ed3c8191f391c03d37760d253e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Tue, 12 Dec 2023 21:25:25 GMT
server: nginx
x-rq: mia2 85 188 443
etag: W/"6578cfc5-bf9"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 p.js Show response
cdn.parsely.com/keys/mercurynews.com/ 56 KB
21 KB 233ms
75ms Script
application/javascript 18.164.101.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/mercurynews.com/p.js?ver=3.12.0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.101.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-101-60.jfk50.r.cloudfront.net
Software: nginx /
Resource Hash: cdd102d71e33401eb5ebadb19f1732edafa44df8800da6d33f29329c3ed9baef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: public
date: Tue, 12 Dec 2023 12:57:17 GMT
content-encoding: gzip
via: 1.1 bf8d7cb6fca5d51158e1109ca40fe242.cloudfront.net (CloudFront)
last-modified: Thu, 09 Dec 2021 15:22:33 GMT
server: nginx
x-amz-cf-pop: JFK50-P5
age: 52912
etag: W/"61b21f39-df44"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400, public
x-amz-cf-id: ts5oyxbbwjxGrXqC5hyOQx-TlsVtUYC_eDTAmtAaS434fsycQEueXQ==
expires: Wed, 13 Dec 2023 12:57:17 GMT

GET
H2 200 ads.js Show response
www.mercurynews.com/wp-content/themes/wp-mason/static/js/ 87 B
323 B 33ms
33ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/wp-content/themes/wp-mason/static/js/ads.js?ver=1.0

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
strict-transport-security: max-age=31536000;includeSubdomains
x-rq: mia2 85 187 443
last-modified: Mon, 05 Dec 2022 16:32:51 GMT
server: nginx
etag: "638e1d33-57"
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 87

GET
H2 200 / Show response
www.mercurynews.com/_static/ 112 KB
31 KB 32ms
32ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/_static/??-eJydzssKwjAQheEXMh1bBFfis8QkbVPnEpxpxbc3oAsFESuc1Q8fHLgWF4QtsYGNiZKCV02moOYtB5gUghAJN2Gc+dxQ5mbSDfzgiuCtz4i6Bp0EYxBfA35htZBX4ReIMojLNDhvdvlEC85DZoXYk/PRkUR947U93qzH2vGSY5I/ZBGrr5/wSId2v+12XV073QEeAphS

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ba5a6577ef04a324ae8a4af890e1e26d341ac85bc5c49ad9be1678a61fcc3168

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Tue, 12 Dec 2023 23:07:01 GMT
server: nginx
x-rq: mia2 85 188 443
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 e-202350.js Show response
stats.wp.com/ 7 KB
3 KB 107ms
36ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202350.js
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT mia
date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/13576-1684460847907.6387
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Mon, 09 Dec 2024 15:18:08 GMT

GET
H2 200 pushly-sdk.min.js Show response
cdn.p-n.io/ 274 KB
57 KB 231ms
73ms Script
application/javascript 13.224.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.4.2
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.214.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-95.phl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c2ce183694d4b007910d545f39982703659724783ea8d385b82027812a4419b7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:36:37 GMT
content-encoding: gzip
via: 1.1 235099561ba63a2b7662a2b20d9ac036.cloudfront.net (CloudFront)
last-modified: Tue, 12 Dec 2023 23:05:31 GMT
server: AmazonS3
x-amz-cf-pop: PHL50-C1
age: 237
x-amz-server-side-encryption: AES256
etag: W/"7935e4b921f84dec802f17d0450badb6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=300
x-amz-cf-id: 5i91XYoKr-nqNEHLhuZ5iY0xVWodMvHxt6H4reFf9Y5rsi2NOQjRAQ==

GET
H2 200 sharing.min.js Show response
www.mercurynews.com/wp-content/mu-plugins/jetpack-12.8/_inc/build/sharedaddy/ 9 KB
3 KB 32ms
32ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/wp-content/mu-plugins/jetpack-12.8/_inc/build/sharedaddy/sharing.min.js?ver=12.8.1

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Tue, 12 Dec 2023 21:25:24 GMT
server: nginx
x-rq: mia2 85 187 443
etag: W/"6578cfc4-2259"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 253ms
96ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyNztEKwyAMBdAfmg1jbOjD2LfY1E6ZGjGR/f5a3dOgsLdLwkkuvItCyuKyQIntGTLDHImSWqmq0uYY2LvKUIgFkEeYtnCCfyk7W9F3POIhX9akpDYWFfIS0ArtXKwE7Px3N6WQD4/57dfLZehNhv+ORjnc5SPdzzej9fWijfkAV5dlLQ==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a2e0d2de51dc225af114789fc0740e5c4e84f03335b755d04bada07003141d8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:24:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 13 Dec 2023 03:39:09 GMT

GET
BLOB 200
OK f0c7cb77-f8f6-4cf7-b267-a19eed8a7366
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/f0c7cb77-f8f6-4cf7-b267-a19eed8a7366
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 101 B
624 B 130ms
60ms Script
text/javascript 2a04:4e42:c00::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?flags=gated&features=es5%2CCustomEvent%2CArray.from%2CArray.isArray%2CArray.prototype.filter%2CArray.prototype.find%2CArray.prototype.findIndex%2CArray.prototype.forEach%2CArray.prototype.indexOf%2CArray.prototype.keys%2CArray.prototype.lastIndexOf%2CArray.prototype.map%2CArray.prototype.reduce%2CDate.prototype.toISOString%2CDocumentFragment%2CDocumentFragment.prototype.append%2CDocumentFragment.prototype.prepend%2CElement%2CElement.prototype.after%2CElement.prototype.append%2CElement.prototype.before%2CElement.prototype.classList%2CElement.prototype.cloneNode%2CElement.prototype.closest%2CElement.prototype.dataset%2CElement.prototype.matches%2CElement.prototype.placeholder%2CElement.prototype.prepend%2CElement.prototype.remove%2CElement.prototype.replaceWith%2CElement.prototype.toggleAttribute%2CEvent%2CJSON%2CMap%2CNumber.parseInt%2CNumber.parseFloat%2CObject.assign%2CObject.create%2CObject.defineProperties%2CObject.defineProperty%2CObject.entries%2CObject.getOwnPropertyDescriptor%2CObject.getOwnPropertyNames%2CObject.is%2CObject.keys%2CObject.values%2CPromise%2CPromise.prototype.finally%2CSet%2CString.prototype.trim%2CXMLHttpRequest%2Cdocument.getElementsByClassName%2Cdocument.currentScript%2Cdocument.querySelector%2Cfetch%2CgetComputedStyle%2ClocalStorage%2CArray.prototype.some%2CDate.now%2CEvent.focusin%2CEventSource%2CFunction.prototype.bind%2CFunction.prototype.name%2CHTMLDocument%2CNodeList.prototype.forEach%2CNodeList.prototype.%40%40iterator%2CNode.prototype.contains%2CObject.getPrototypeOf%2CObject.setPrototypeOf%2CRegExp.prototype.flags%2CString.prototype.%40%40iterator%2CString.prototype.startsWith%2CString.prototype.endsWith%2Cconsole%2Cconsole.debug%2Cconsole.error%2Cconsole.info%2Cconsole.log%2Cdocument%2Cdocument.head%2Cdocument.visibilityState%2Clocation.origin%2CrequestIdleCallback%2Cscreen.orientation%2CmatchMedia%2CURL

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:c00::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 13 Dec 2023 03:39:09 GMT
age: 2682934
detected-user-agent: Chrome Mobile WebView/120.0.6099
server-timing: HIT, fastly;desc="Edge time";dur=1
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 120
referrer-policy: origin-when-cross-origin
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/120.0.0
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
250 B 108ms
106ms XHR
application/json 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDJUi9DGZnqI8YbyBueZXiiJjKzw9kGDlE&ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.mercurynews.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 session Show response
session.mercurynews.com/api/ 112 B
276 B 463ms
110ms XHR
application/json 35.164.107.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://session.mercurynews.com/api/session
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXso0bgifx6mu0WygpTRwmRR9/8SC4k+AgEPKTfIfAcwnTXQzFYGm9kCiwlDBTIe1ZQS0ZTZssciKJucvcMFY9wD+GHwi+bC/jy2QN2bvutTrd0ht4/ICUDMNmyEnKh6xfWWR/VNUrX4bzcTyNXkNdAdfWi0k=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.164.107.88 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-164-107-88.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 3dddc9ec1713ed777eb9873d6911e812e11344360a7945ed6206ab09e1948b40

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: https://www.mercurynews.com
date: Wed, 13 Dec 2023 03:39:10 GMT
access-control-allow-credentials: true
content-length: 112
vary: Origin
content-type: application/json; charset=utf-8

GET
H2 200 cs Show response
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 16 B
698 B 532ms
387ms Script
text/javascript 52.6.88.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json156

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.6.88.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

- /

Resource Hash

19a2ce89fe203fb88ede262499f01eb33678fdc3957bd2e9fa74b8a2b941cbcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: -
x-permitted-cross-domain-policies: master-only
content-type: text/javascript; charset=utf-8
p3p: policyref="", CP="DSP"
cache-control: no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag: noindex, nofollow
content-length: 36
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 cs Show response
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 16 B
702 B 202ms
58ms Script
text/javascript 52.6.88.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json157

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.6.88.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-6-88-177.compute-1.amazonaws.com

Software

- /

Resource Hash

d07d1123d924520b0f333c199d46076b5e0a9c49765d6fb2563dc55a4f56f260

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: -
x-permitted-cross-domain-policies: master-only
content-type: text/javascript; charset=utf-8
p3p: policyref="", CP="DSP"
cache-control: no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag: noindex, nofollow
content-length: 36
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

web-vitals.iife.js Show response
unpkg.com/web-vitals@3.5.0/dist/
Redirect Chain

https://unpkg.com/web-vitals@3/dist/web-vitals.iife.js
https://unpkg.com/web-vitals@3.5.0/dist/web-vitals.iife.js

7 KB
3 KB

50ms
49ms

Script
application/javascript

2606:4700::6810:7caf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/web-vitals@3.5.0/dist/web-vitals.iife.js

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Server

2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7688a97a3cf3ee4a4f04f8b3596ca5c89d63f4e57280907e688dcdd8dd52b49f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 2148530
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HFGK3KBTXYY7AE8F2D8SCHTK-mia
server: cloudflare
etag: W/"1c0d-zW8RvTlYH7YAF4tIT+4z8RfNaCg"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 834b2dab5a9b749a-MIA

Redirect headers

date: Wed, 13 Dec 2023 03:39:09 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01HHGKR6JZKNBENVM676CG9Q4Z-mia
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 371
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /web-vitals@3.5.0/dist/web-vitals.iife.js
cache-control: public, s-maxage=600, max-age=60
cf-ray: 834b2daa891d749a-MIA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 595 KB
139 KB 259ms
98ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fc7e2e3e03e0b0dd2e8373c0949e6c252982d57f9cd5d6fcf82ea22f383c0209

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141609
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 13 Dec 2023 03:39:09 GMT

GET
H2 200 mn-logo.svg
www.mercurynews.com/wp-content/uploads/2020/09/ 12 KB
12 KB 32ms
32ms Image
image/svg+xml 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mercurynews.com/wp-content/uploads/2020/09/mn-logo.svg

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:09 GMT
strict-transport-security: max-age=31536000;includeSubdomains
x-rq: mia2 80 130 443
last-modified: Wed, 23 Sep 2020 17:38:16 GMT
server: nginx
etag: "497950346404e2d1"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 12014

GET
DATA 200
OK truncated
/ 28 KB
28 KB Font
font/truetype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 69e30805defbf34fa451a87b0d7c41026d31d627fcb0cc8a2b63a8fd87d08888

Request headers

Referer
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: font/truetype

GET
H2 200 SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
fonts.gstatic.com/s/droidsans/v18/ 22 KB
22 KB 377ms
213ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidsans/v18/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:49:09 GMT
x-content-type-options: nosniff
age: 496200
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22376
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:25:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 09:49:09 GMT

GET
H3 200 bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/ 88 KB
89 KB 71ms
32ms Font
font/woff2 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0

Protocol

Security

QUIC, , AES_256_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 13 Dec 2023 03:39:09 GMT
x-content-type-options: nosniff
age: 3039442
x-jsd-version: 1.5.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 90528
x-served-by: cache-fra-eddf8230031-FRA, cache-mia-kmia1760024-MIA
x-jsd-version-type: version
etag: W/"161a0-RkmHeGigBozlCxBdDSojXoAQyY8"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
fonts.gstatic.com/s/droidsans/v18/ 21 KB
21 KB 308ms
145ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidsans/v18/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:49:10 GMT
x-content-type-options: nosniff
age: 496199
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21224
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:04:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 09:49:10 GMT

GET
H2 200 tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
fonts.gstatic.com/s/droidserif/v19/ 25 KB
25 KB 338ms
175ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidserif/v19/tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa898d9bdc34304905c4b165e561c8dc3fe452b0bdd7259140e1aa530a42136

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:50:36 GMT
x-content-type-options: nosniff
age: 496113
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25980
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:47:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 09:50:36 GMT

GET
H2 200 tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
fonts.gstatic.com/s/droidserif/v19/ 22 KB
22 KB 239ms
77ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidserif/v19/tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aee4051a20e975b9bb6fdc20984a091eb1f55c35ea87abe441db4cdbe8c116d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:50:36 GMT
x-content-type-options: nosniff
age: 496113
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22476
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:19:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 09:50:36 GMT

GET
H/1.1 200
OK /
p1.parsely.com/plogger/ 43 B
260 B 264ms
57ms Image
image/gif 54.144.144.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p1.parsely.com/plogger/?rand=1702438749946&plid=15628744&idsite=mercurynews.com&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&sref=&sts=1702438749934&slts=0&title=Russian+man+flies+from+Denmark-LAX+with+no+ticket%2C+passport&date=Tue+Dec+12+2023+17%3A39%3A09+GMT-1000+(Hawaii-Aleutian+Standard+Time)&action=pageview&pvid=2808414&u=pid%3Df251693e879525615d446aad07ef0620
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.144.144.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-144-144-142.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:10 GMT
Cache-Control: no-cache
Last-Modified: Wednesday, 13-Dec-2023 03:39:10 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 common.chunk.min.js Show response
www.mercurynews.com/wp-content/themes/assets/static/js/ 42 KB
11 KB 37ms
36ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/wp-content/themes/assets/static/js/common.chunk.min.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cbccc935557398179deeef044a5ab2353e97ca4961f313793c8ba03964c43e93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Tue, 12 Dec 2023 23:07:01 GMT
server: nginx
x-rq: mia2 85 188 443
etag: W/"6578e795-a619"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 common-async.chunk.min.js Show response
www.mercurynews.com/wp-content/themes/assets/static/js/ 64 KB
9 KB 36ms
35ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/wp-content/themes/assets/static/js/common-async.chunk.min.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7c51552210cf46e54bf684795ac5ac9b03af17e73f0c96fbf03a798ecb56e49e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Tue, 12 Dec 2023 23:07:01 GMT
server: nginx
x-rq: mia2 85 187 443
etag: W/"6578e795-10029"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 boldcoastal-async.chunk.min.js Show response
www.mercurynews.com/wp-content/themes/assets/static/js/ 3 KB
2 KB 33ms
33ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/wp-content/themes/assets/static/js/boldcoastal-async.chunk.min.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4d04e98fa76e2cdba4b0b45b0b206b13de39ff72f6371b7d97ed515e21646722

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Tue, 12 Dec 2023 23:07:01 GMT
server: nginx
x-rq: mia2 85 187 443
etag: W/"6578e795-c75"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 mn-logo.svg
www.mercurynews.com/wp-content/uploads/2020/09/ 12 KB
12 KB 33ms
32ms Image
image/svg+xml 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mercurynews.com/wp-content/uploads/2020/09/mn-logo.svg

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
strict-transport-security: max-age=31536000;includeSubdomains
x-rq: mia2 80 130 443
last-modified: Wed, 23 Sep 2020 17:38:16 GMT
server: nginx
etag: "497950346404e2d1"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 12014

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 140ms
33ms Script
application/x-javascript 2606:2800:11f:17a5:191a:18d5:537:22f9
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mic/9B3E) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 710
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (mic/9B3E)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 29eced02-f01e-0025-6974-2d8eb2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Wed, 13 Dec 2023 04:09:10 GMT

GET
H2 200 loader-config.json Show response
loader-cdn.azureedge.net/prod/dfm/ 4 KB
2 KB 138ms
33ms Fetch
application/json 2606:2800:11f:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://loader-cdn.azureedge.net/prod/dfm/loader-config.json
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mic/9AC8) /
Resource Hash: 5ce0cb7f558c1aca9c6e94c7d85d76db859218132923c039b7ef7b38a29f8dfd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
content-md5: 1iDtMuqZEAqLGRPxG2wEug==
age: 27495
x-cache: HIT
content-length: 1300
x-ms-lease-status: unlocked
last-modified: Mon, 12 Jun 2023 07:44:01 GMT
server: ECAcc (mic/9AC8)
etag: 0x8DB6B18C9F2D8E6
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 6ee1c0af-301e-0048-5935-2dea89000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 160 B
1 KB 845ms
844ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A10-10%3A00&ts=1702438750031

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

09710269d645df066bc174b40b9d4d94588923b65467451288d16dcba7d394dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 157
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: zrPB3pdzv3wXj05y-JlqmOavf1SnMuMhATEAFG_76jrs0Gfa0FRZhQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 / Show response
cmp.osano.com/ Frame E9BE 4 KB
1 KB 67ms
66ms Document
text/html 2600:9000:2510:3600:3:b7e:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cmp.osano.com/

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2510:3600:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 27984
alt-svc: h3=":443"; ma=86400
content-encoding: br
content-type: text/html
date: Tue, 12 Dec 2023 19:52:47 GMT
etag: W/"287b497c992487af362d33204f87d28f"
last-modified: Thu, 21 Oct 2021 22:01:08 GMT
referrer-policy: strict-origin-when-cross-origin
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding Origin
via: 1.1 bf8d7cb6fca5d51158e1109ca40fe242.cloudfront.net (CloudFront)
x-amz-cf-id: Saqywl5meCrm9ri1JJdkS_XEule6NQc9gPlRYLYuL8yPPXW570_hlg==
x-amz-cf-pop: JFK50-P5
x-amz-version-id: xT1PkIFehetvNf5lINcU02FbT3u47kBr
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 g.gif
pixel.wp.com/ 50 B
153 B 35ms
32ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=116372247&post=10256073&tz=-8&srv=www.mercurynews.com&hp=vip&j=1%3A12.8.1&host=www.mercurynews.com&ref=&fcp=776&rand=0.9509760489909937
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 13 Dec 2023 03:39:10 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 wp-emoji-release.min.js Show response
www.mercurynews.com/wp-includes/js/ 18 KB
5 KB 33ms
32ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mercurynews.com/wp-includes/js/wp-emoji-release.min.js?ver=6.4.2

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000;includeSubdomains
last-modified: Wed, 06 Dec 2023 23:24:04 GMT
server: nginx
x-rq: mia2 85 188 443
etag: W/"65710294-4904"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
DATA 200
OK truncated
/ 3 KB
3 KB Image
img/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 14f3a2330f6d02bcd5407635a03c7ab8ed1aa494914c05881137c5e86ae20acf

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: img/png

GET
DATA 200
OK truncated
/ 3 KB
3 KB Image
img/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f6d8894bccb6968f9c55a23894a63a454f3425a7a4c19251ba01d9e3493084a0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: img/png

GET
H2 200 state-ny.png
www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/ 10 KB
10 KB 33ms
31ms Image
image/png 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/state-ny.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f9c4ffcfab2c93ba07bd2d4a2dd53a1d23faace457ade18c52c3f4ea67b8ea68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/_static/??-eJyNztEKwyAMBdAfmg1jbOjD2LfY1E6ZGjGR/f5a3dOgsLdLwkkuvItCyuKyQIntGTLDHImSWqmq0uYY2LvKUIgFkEeYtnCCfyk7W9F3POIhX9akpDYWFfIS0ArtXKwE7Px3N6WQD4/57dfLZehNhv+ORjnc5SPdzzej9fWijfkAV5dlLQ==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
strict-transport-security: max-age=31536000;includeSubdomains
x-rq: mia2 85 187 443
last-modified: Mon, 05 Dec 2022 16:32:50 GMT
server: nginx
etag: "638e1d32-26da"
x-cache: HIT
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 9946

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ 47 KB
47 KB 118ms
117ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 20:58:17 GMT
x-content-type-options: nosniff
age: 542453
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48432
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 00:40:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Dec 2024 20:58:17 GMT

GET
H2 200 mercurynews.com Show response
pubcast-files.remixd.com/player-configs/ 8 KB
9 KB 143ms
34ms Fetch
application/json 35.190.38.143
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pubcast-files.remixd.com/player-configs/mercurynews.com
Requested by: Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 143.38.190.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f9d24c71e954513157a412b5339112437e013cf99070b258e445101f16747500

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:14:18 GMT
age: 1492
x-guploader-uploadid: ABPtcPqcg389a-Ynb4Hn4UDRzUFXp0KDUuHYIiy9w2FQ7X_p9ckxs0YHdVKKgeHXBQGqLdeG04A
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8352
last-modified: Thu, 15 Jun 2023 11:20:10 GMT
server: UploadServer
etag: "50de11d656548e115c3b3202413c53f2"
x-goog-generation: 1686828010228687
x-goog-hash: crc32c=wwSIAQ==, md5=UN4R1lZUjhFcOzICQTxT8g==
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=3600
x-goog-meta-cache-control: public, no-cache, must-revalidate
x-goog-stored-content-length: 8352
accept-ranges: bytes
content-type: application/json
expires: Wed, 13 Dec 2023 04:14:18 GMT

GET
BLOB 200
OK d78409a4-c793-456f-a005-da495f7ad8e5
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/d78409a4-c793-456f-a005-da495f7ad8e5
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

POST
H2 422 vitals
www.foo.software/api/ 0
100 B 246ms
73ms Ping
text/plain 137.184.240.117
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.foo.software/api/vitals
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 137.184.240.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.25.3 / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 13 Dec 2023 03:39:10 GMT
server: nginx/1.25.3
x-powered-by: Express

GET
H2 200 pushly-sdk.min.js Show response
cdn.p-n.io/ 274 KB
57 KB 110ms
110ms Script
application/javascript 13.224.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.4.2
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.214.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-95.phl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c2ce183694d4b007910d545f39982703659724783ea8d385b82027812a4419b7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:36:37 GMT
content-encoding: gzip
via: 1.1 235099561ba63a2b7662a2b20d9ac036.cloudfront.net (CloudFront)
last-modified: Tue, 12 Dec 2023 23:05:31 GMT
server: AmazonS3
x-amz-cf-pop: PHL50-C1
age: 238
x-amz-server-side-encryption: AES256
etag: W/"7935e4b921f84dec802f17d0450badb6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=300
x-amz-cf-id: f-4USyrQnmb4HeG_WffRycEp1Dt42YRbVGImUM0fK_NC5cMABZaQ9Q==

GET
H3 200 / Show response
cmp.osano.com/ Frame 6FBE 4 KB
1 KB 68ms
67ms Document
text/html 2600:9000:2510:3600:3:b7e:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cmp.osano.com/

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:9000:2510:3600:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 27984
alt-svc: h3=":443"; ma=86400
content-encoding: br
content-type: text/html
date: Tue, 12 Dec 2023 19:52:47 GMT
etag: W/"287b497c992487af362d33204f87d28f"
last-modified: Thu, 21 Oct 2021 22:01:08 GMT
referrer-policy: strict-origin-when-cross-origin
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding Origin
via: 1.1 3b0649a8bee506c1d7498462d39e6c44.cloudfront.net (CloudFront)
x-amz-cf-id: BB-DrXjGTA23Dn1k8nkGlALPdFwXGQiYTks-3J3RsUYIolTDlEVCBA==
x-amz-cf-pop: JFK50-P5
x-amz-version-id: xT1PkIFehetvNf5lINcU02FbT3u47kBr
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

OPTIONS
H2 200 record
consent.api.osano.com/ Frame 0
0 304ms
94ms Preflight
application/json 3.162.3.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.api.osano.com/record
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-64.yul62.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.mercurynews.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Wed, 13 Dec 2023 03:39:10 GMT
via: 1.1 1f0f1388abc5c7a2f1935aa322216120.cloudfront.net (CloudFront)
x-amz-apigw-id: P3MWzGXOIAMEnXw=
x-amz-cf-id: KMIXeKluzAHSt3kWCJIjnnA3uC95rTVQn51mv2rufaNglYvR2HQ-Hg==
x-amz-cf-pop: YUL62-P2
x-amzn-requestid: 37e6dd60-8537-49a2-bc61-15a580c1e7e7
x-cache: Miss from cloudfront

GET
H2 200 htlbid.js Show response
htlbid.com/v3/mercurynews.com/ 483 KB
128 KB 68ms
66ms Script
application/javascript 18.238.55.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.55.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-55-118.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d06c3c62c99998240939c48f2f0fd8004362a70409e86fec5e35d278711a8a7f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: br
via: 1.1 8df8d5dfeb782c83ceeb5679f78a9e4e.cloudfront.net (CloudFront)
last-modified: Mon, 04 Dec 2023 10:22:57 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P4
age: 1
x-amz-server-side-encryption: AES256
etag: W/"6d07077c4dd5cd7f4b601ecb59795cb3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=600
x-amz-cf-id: jql0uBd3nnVBUwuloyw2ZrST3-0ObFi4VdiufMPSK9VDaHF8JjqFeQ==

GET
H2 200 loader.js Show response
cdn.taboola.com/libtrc/medianewsgroup-network/ 444 KB
58 KB 112ms
34ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/medianewsgroup-network/loader.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f73fd54f46d0695a09570226a04aac4f3238fd072232ec4e824e3c37d6162e1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: MYKnYQRFlVeMZLL1IMNuNNDAsUz6Fkuc
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:10 GMT
x-amz-request-id: NED4XMPB1NEAXWEC
age: 73
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: FAILED
content-length: 58750
x-amz-id-2: ZrA3HWCMBej8ESTf7wmFRm4hM4++/HZEkSKkWPB7B44lfjSwvb/6WuFYsCIoFfMiE3Cb6hjy4OU=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 17:07:27 GMT
server: AmazonS3
x-timer: S1702438750.255514,VS0,VE2
etag: "ad0e8af61fe725e7ea67dae3bf628f8e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 75
access-control-allow-origin: *
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 1

GET
H/1.1 200
OK load.js Show response
s.ntv.io/serve/ 620 KB
164 KB 253ms
86ms Script
application/x-javascript 23.200.165.39
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ntv.io/serve/load.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.200.165.39 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-165-39.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: c1f45712fc1017c00e04f809fbaf6cd1e4b0bb68072159b1f122099ec32e8a77

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:10 GMT
Content-Encoding: gzip
x-amz-request-id: M699EPH369Q3XEM3
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
x-amz-id-2: ff9F8o7f9UTxxDfA4leEtj+by0rKQa9uuFWRaT903+gBWCVki/slN9NBjLWOaIdV4pX10yPyomE=
Last-Modified: Tue, 12 Dec 2023 00:33:19 GMT
Server: AmazonS3
ETag: "b39602292d2e25beb594ba48d0d6e46a"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

POST
H2 204 record Show response
consent.api.osano.com/ 0
438 B 193ms
192ms XHR
text/plain 3.162.3.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.api.osano.com/record
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-64.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
via: 1.1 1f0f1388abc5c7a2f1935aa322216120.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P2
x-amzn-trace-id: Root=1-6579275e-5bda39b03902bd78311e72ba
x-amzn-requestid: bde04d44-7aed-4f8f-bd69-77cac79928d7
x-cache: Miss from cloudfront
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: *
access-control-allow-headers: Accept, Authorization, Content-Length, Content-Type, Origin, X-Requested-With
x-amz-apigw-id: P3MW0GvLIAMEFMw=
x-amz-cf-id: 24UEZN2d4mer0PX5PCC7EmfeN1L9K_lSxkVnZd5W2VBtSK_yYDqFlg==

GET
H2 200 fp.min.js Show response
cdn.mircheigeshoa.com/prod/dfm/ 66 KB
23 KB 152ms
38ms Script
application/javascript 2606:2800:11f:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mircheigeshoa.com/prod/dfm/fp.min.js?20231112
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mic/9B2D) /
Resource Hash: eab6233096b857ecda13c7f64b1cee3378457faa09df4db474f765029f2fe921

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
content-md5: uNbNlIeYZ9WdMaBieS7wbw==
age: 38627
x-cache: HIT
content-length: 23529
x-ms-lease-status: unlocked
last-modified: Mon, 04 Dec 2023 04:53:57 GMT
server: ECAcc (mic/9B2D)
etag: 0x8DBF4850646CDD0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: c76b315b-201e-0019-801b-2d7705000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 g2i.min.js Show response
cdn.o1ych4jb.com/prod/dfm/ 220 KB
48 KB 151ms
36ms Script
application/x-javascript 2606:2800:11f:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.o1ych4jb.com/prod/dfm/g2i.min.js?20231112
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mic/9AAF) /
Resource Hash: 2c680585f7539239f507f97c7fb26dbfa6587912dc02ac0a3304fd44ed0e71d7

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
content-md5: ZQaVXu7qugpZxdJSUeu8jw==
age: 38739
x-cache: HIT
content-length: 49063
x-ms-lease-status: unlocked
last-modified: Mon, 04 Dec 2023 04:51:50 GMT
server: ECAcc (mic/9AAF)
etag: 0x8DBF484BA8D6C66
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 19ca4110-701e-002b-301b-2d7772000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 t8y9347t.min.js Show response
cdn.pranmcpkx.com/prod/dfm/ 1 MB
398 KB 209ms
56ms Script
application/javascript 2606:2800:11f:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pranmcpkx.com/prod/dfm/t8y9347t.min.js?20231112
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mic/9B9A) /
Resource Hash: 093143c69ab4e2445966c6f11ead651578eb5f27d41bf6b4223bdafb7e2b8ece

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
content-md5: Btx3eHF4CLnE1tcwI/UASg==
age: 946
x-cache: HIT
content-length: 406855
x-ms-lease-status: unlocked
last-modified: Mon, 04 Dec 2023 05:09:31 GMT
server: ECAcc (mic/9B9A)
etag: 0x8DBF48732A29F74
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: ae4d69be-e01e-005b-0873-2dce85000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 t8y9347t.min.css
cdn.pranmcpkx.com/prod/dfm/ 396 KB
55 KB 149ms
35ms Stylesheet
text/css 2606:2800:11f:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pranmcpkx.com/prod/dfm/t8y9347t.min.css?20231112
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mic/9B0F) /
Resource Hash: 2daf4f648f61913798a435e8a7de48bc507cef6d1beef4a05e314dad8db6f4bf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
content-md5: KGAI+MIxF0Nl5uOt1Fi9/Q==
age: 946
x-cache: HIT
content-length: 55720
x-ms-lease-status: unlocked
last-modified: Mon, 04 Dec 2023 05:09:30 GMT
server: ECAcc (mic/9B0F)
etag: 0x8DBF487329C5ED0
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 73f0892c-c01e-0011-5c73-2d6d0a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2

200

landing
googleads.g.doubleclick.net/pagead/
Redirect Chain

https://www.google.com/pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=560454106.1702438750&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-...
https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=560454106.1702438750&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-wi...

42 B
588 B

265ms
98ms

Ping
image/gif

2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=560454106.1702438750&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&dma=0&tcfd=10000&gtm=45He3bt0n71TLFP4Rv71194413&auid=1602369993.1702438750

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:10 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:10 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=560454106.1702438750&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&dma=0&tcfd=10000&gtm=45He3bt0n71TLFP4Rv71194413&auid=1602369993.1702438750
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 21 KB
9 KB 231ms
65ms Script
application/javascript 2620:116:800b:21:4cb8:1820:80ca:50f7
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800b:21:4cb8:1820:80ca:50f7 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 77daa4388c965a3e23b5a6c800727d8025ab108f89cf5679e79136986d5b4561

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
etag: "e23JaXq4HVtlOmThpFhluQ=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Wed, 20 Dec 2023 03:39:10 GMT

GET
H2

200

activityi;dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=;ua... Show response
13619678.fls.doubleclick.net/ Frame 119F
Redirect Chain

https://13619678.fls.doubleclick.net/activityi;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=...
https://13619678.fls.doubleclick.net/activityi;dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gc...

675 B
562 B

106ms
105ms

Document
text/html

172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://13619678.fls.doubleclick.net/activityi;dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

cafe /

Resource Hash

d3dbbbef382eb010caecfa13a3c0670b0743fdb5413a1010c54779f182111b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 386
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 13 Dec 2023 03:39:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 13 Dec 2023 03:39:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://13619678.fls.doubleclick.net/activityi;dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 a-04i4.min.js Show response
b-code.liadm.com/ 47 KB
15 KB 265ms
86ms Script
application/javascript 2600:9000:215f:d000:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-04i4.min.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:d000:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: f27352e32ef37025ab0ef98afc90400af6bfac7cfe2df9c459e96bcb353a327d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 19:14:37 GMT
content-encoding: gzip
via: 1.1 fdced9a893123e4285bf6f674dce492c.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-C2
age: 30273
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: lDg3MY3SYT9L8UxllC9nzh2NEfbIwb6t6NDjgkcFVQn0mShlC8I96g==

GET
H2

200

asyncPixelSync Show response
pixel.sitescout.com/dmp/ Frame C356
Redirect Chain

https://pixel.sitescout.com/dmp/asyncPixelSync
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1

1 KB
2 KB

57ms
57ms

Document
text/html

207.198.113.205
COGECO-PEER1

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 207.198.113.205 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: A /
Resource Hash: 06a7a40f813d08f25faeb793e8eed0514e1e3f8828ca19b728e0383fce135fc3

Request headers

Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0,no-cache,no-store
content-length: 1174
content-type: text/html;charset=UTF-8
date: Wed, 13 Dec 2023 03:39:10 GMT
expires: Tue, 11 Oct 1977 12:34:56 GMT
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
server: A

Redirect headers

content-length: 0
date: Wed, 13 Dec 2023 03:39:09 GMT
location: https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
server: A

GET
H2 200 launchpad-liveramp.js Show response
launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/ 17 KB
3 KB 267ms
75ms Script
text/javascript 54.192.51.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/launchpad-liveramp.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-71.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f35a7a3eb28e1da39e87276b8f75d6203b808e26b63218ffb0be3fd62e0de605

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: 0wgTlvozKv_yHsVhsA.bHuhm0r2Cnphv
content-encoding: gzip
via: 1.1 b6989f0f2e150081d90f4c11e6692d3e.cloudfront.net (CloudFront)
date: Tue, 12 Dec 2023 07:10:48 GMT
x-amz-cf-pop: YUL62-C2
age: 73822
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-disposition: attachment; filename="launchpad-liveramp.js"
last-modified: Sun, 27 Aug 2023 22:55:22 GMT
server: AmazonS3
etag: W/"e1e9408aa4a994afbbb535269e3387fb"
vary: Accept-Encoding
content-type: text/javascript
x-amz-cf-id: _PuP70383mevc5K2PE2SnGVxzGPVyX9UWewDZqKjTMohDWZp_c6ZXA==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 149 KB
57 KB 100ms
100ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11039244145

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e5e900c22b46451e81df30dfb023922716e5c5120ecb3756c64794616eb354f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57938
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 13 Dec 2023 03:39:10 GMT

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1702438750340&ns_c=UTF-8&c8=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&c7=https%3A%2F%2Fwww.mercurynews.c...
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1702438750340&ns_c=UTF-8&c8=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&c7=https%3A%2F%2Fwww.mercurynews....

0
225 B

102ms
102ms

Image
text/plain

13.225.195.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1702438750340&ns_c=UTF-8&c8=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&c9=
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 13.225.195.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-195-113.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
via: 1.1 bab918d4b27bc252683dafa737d07e68.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: YUL62-C1
x-amz-cf-id: Y95Kva0vJ88ZAQc6yOfIgtQNYZyTZ8-kI0mx6ek4hbTQe1slmXmazg==
x-cache: Miss from cloudfront

Redirect headers

date: Wed, 13 Dec 2023 03:39:10 GMT
via: 1.1 bab918d4b27bc252683dafa737d07e68.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: YUL62-C1
x-cache: Miss from cloudfront
location: /b2?c1=2&c2=6035443&ns__t=1702438750340&ns_c=UTF-8&c8=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&c9=
content-length: 0
x-amz-cf-id: sSonWIJYcNrK2SnE05p5KytqCuj8TOpC5e-aoaFW5UZHVIlCSm0lbw==

GET
H2

204

d66dfa6e9938b7de
pixel.sitescout.com/iap/
Redirect Chain

https://pixel.sitescout.com/iap/d66dfa6e9938b7de
https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1

0
341 B

58ms
57ms

Image
text/plain

207.198.113.205
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 207.198.113.205 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:09 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
expires: Tue, 11 Oct 1977 12:34:56 GMT

Redirect headers

location: https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
date: Wed, 13 Dec 2023 03:39:09 GMT
server: AC1.1
content-length: 0

GET
H2

200

segment
di.rlcdn.com/api/
Redirect Chain

https://di.rlcdn.com/406006.gif?pdata=partner%3Dtap486987%2Cdata%3Dtype%3Asite%24audience%3AMSO_MercuryNews_ClientSite_Control
https://di.rlcdn.com/api/segment?pdata=partner%3Dtap486987%2Cdata%3Dtype%3Asite%24audience%3AMSO_MercuryNews_ClientSite_Control&pid=406006&redirect=1

0
59 B

71ms
70ms

Image
application/javascript

34.107.140.17
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://di.rlcdn.com/api/segment?pdata=partner%3Dtap486987%2Cdata%3Dtype%3Asite%24audience%3AMSO_MercuryNews_ClientSite_Control&pid=406006&redirect=1
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 34.107.140.17 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 17.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
via: 1.1 google
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

Redirect headers

date: Wed, 13 Dec 2023 03:39:10 GMT
via: 1.1 google
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://di.rlcdn.com/api/segment?pdata=partner%3Dtap486987%2Cdata%3Dtype%3Asite%24audience%3AMSO_MercuryNews_ClientSite_Control&pid=406006&redirect=1
content-type
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 standard-player.html Show response
tags.remixd.com/player/v5/players/ 130 KB
30 KB 195ms
71ms Fetch
text/html 13.225.214.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.remixd.com/player/v5/players/standard-player.html
Requested by: Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.214.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-63.ewr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 818b515528e75d20a6c1714a3b808a2877a724d51c984a0bd9e8c244ce9ce3d8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:38:30 GMT
content-encoding: gzip
via: 1.1 5dccc983b54773fbbd262d2029a805d6.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
age: 41
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 29827
last-modified: Tue, 31 Oct 2023 15:34:26 GMT
server: AmazonS3
etag: "1a9dd5e9554676ab1900727441a87258"
access-control-max-age: 60
access-control-allow-methods: GET, HEAD
content-type: text/html
access-control-allow-origin: *
cache-control: public,max-age=1800
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: H7dBDlU_-abPW_GvYb0DFI5CXj5yTFibfr0rLdKrSmtkWU1jyyUagQ==

GET
BLOB 200
OK 69455089-dd96-4595-89a8-79695291356f
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/69455089-dd96-4595-89a8-79695291356f
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
BLOB 200
OK 1e6f6215-b25a-42f6-8d67-8dd1f9ede1e0
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/1e6f6215-b25a-42f6-8d67-8dd1f9ede1e0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
BLOB 200
OK 609b53bc-dfe9-4417-a778-90617065d7b5
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/609b53bc-dfe9-4417-a778-90617065d7b5
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
BLOB 200
OK a9ab204c-f5bb-4ed0-bd59-08672463c905
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/a9ab204c-f5bb-4ed0-bd59-08672463c905
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 style
accounts.google.com/gsi/ 533 B
608 B 120ms
118ms Stylesheet
text/css 2607:f8b0:4020:807::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/style

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200d Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-LWka3hNJuo51IZej5aSLsw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-security-policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-LWka3hNJuo51IZej5aSLsw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type: text/css; charset=utf-8
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires: Wed, 13 Dec 2023 03:39:10 GMT

GET
H2 200 status Show response
accounts.google.com/gsi/ 40 B
528 B 115ms
108ms XHR
application/json 2607:f8b0:4020:807::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/status?client_id=682906792919-57292pukl717kpesjb0r4cnr5342j506.apps.googleusercontent.com&as=r1cZgggmceVbUZ%2FNiIzRhA

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/gsi/client?ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200d Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

eb5098fea4b0eb60ca3c0b6a4723f94e688c49aca875d177a847d26aab834157

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-f_zL7e0YUi4W56cmHgKtzg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-security-policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-f_zL7e0YUi4W56cmHgKtzg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
x-content-type-options: nosniff
content-encoding: gzip
content-disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
server: ESF
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 90 KB
29 KB 307ms
128ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e6423090d7bd67f70d831aa26345d442105370bc704592569686c60114f45e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29525
x-xss-protection: 0
server: cafe
etag: 546 / 19704 / 31080056 / config-hash: 6487957748488688722
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 13 Dec 2023 03:39:10 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/mng-trib/ 16 KB
7 KB 285ms
77ms Script
application/javascript 3.161.213.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/mng-trib/op.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-54.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b7b5069958cdb07fb954d366121918036104435f72f60fa87fb7e74effb846a3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: TzWr_xLS2z3lhdI9AmMFOIkflt8bywTw
content-encoding: gzip
via: 1.1 82411d437ee2d2355a407b78473e6156.cloudfront.net (CloudFront)
date: Wed, 13 Dec 2023 03:12:33 GMT
x-amz-cf-pop: YUL62-P1
age: 1598
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 7055
x-amz-meta-git_commit: 34df212
last-modified: Tue, 12 Dec 2023 19:32:30 GMT
server: AmazonS3
etag: "971da55098a5a068d26841fe007ac650"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
accept-ranges: bytes
x-amz-cf-id: wdGxzQx0Vi-xy2A9xOt1nWDGYsvO4A2wsT77jrKLkTPL7VJxNHE96Q==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 282 KB
70 KB 204ms
68ms Script
application/javascript 18.238.64.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.64.130 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-64-130.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4d3c300c1cd89393c7f945c06656981e3ac1c034f59996affcd1062a3092f40c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:32:53 GMT
content-encoding: gzip
via: 1.1 c84ecfd128e1f4c41a53a2b42410f3b8.cloudfront.net (CloudFront), 1.1 071f5fea9cc276d1769e252ea33022fa.cloudfront.net (CloudFront)
last-modified: Tue, 12 Dec 2023 22:20:09 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, JFK52-P4
age: 378
x-amz-server-side-encryption: AES256
etag: W/"d6937d02acbbf691a008906e9d0617e0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: BVbsGJryRhHzvba9A7XdOArQoMHSUK0YS3n254rFKOyb7NoYDkeY4Q==

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 136 KB
21 KB 109ms
108ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

c12c41b292bb7c884bef4cfb30a8cdcf0272cc6d5954b3a74b3123256b70916a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 20647
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: UPTqVkEk3jxuFIXecfLvdMEbJXsP5xcTY7CuimbeSfsjVa6cyHx61g==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 impl.20231212-21-RELEASE.js Show response
cdn.taboola.com/libtrc/ 820 KB
170 KB 33ms
32ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20231212-21-RELEASE.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: 02d5a1f941548c2d907a716f771f7c8bd1de03d6ffec7b38a9614df6526ce245

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: 5d9XpIbsXaD6YHEJPM3ol6nWZW2PJyvS
content-encoding: br
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:10 GMT
x-amz-request-id: SNBB7X35F29AH592
age: 17946
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 173935
x-amz-id-2: 2jg9bU+ElNLLyq8YmsHY9qOFdLepCE5O0aoqF9TTmVedPJgaQndtMo2JEcoEeAN/Yy+FzgHu3r4=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 14:39:49 GMT
server: AmazonS3-br
x-timer: S1702438751.608578,VS0,VE0
etag: "3c5a9fa5d82fb94f2365b4877634eacb"
vary: Accept-Encoding
content-type: application/javascript
abp: 74
access-control-allow-origin: *
cache-control: private,max-age=31536000
accept-ranges: bytes
x-cache-hits: 6

GET
BLOB 200
OK 6cc7a3b1-e4e6-4643-a8bf-646d8560ab65
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/6cc7a3b1-e4e6-4643-a8bf-646d8560ab65
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 279 KB
92 KB 98ms
98ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f2cdb5bf5179236f3363c6ebdafceba9ec61b8d325cea3fed9a28ef66f0c4a89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93868
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 13 Dec 2023 03:39:10 GMT

GET
H/1.1 200
OK tag.js Show response
s.btstatic.com/ 34 KB
13 KB 250ms
71ms Script
application/javascript 104.91.98.176
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.btstatic.com/tag.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.91.98.176 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-91-98-176.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:10 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Feb 2023 15:10:42 GMT
Server: nginx
Vary: Accept-Encoding
P3P: CP=NOI DSP COR NID
Content-Type: application/javascript
Cache-Control: public, max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 12525

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 235ms
72ms Script
text/javascript 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 13 Dec 2023 02:52:28 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2802
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 13 Dec 2023 04:52:28 GMT

GET
H2

200

ml.br.js Show response
js.matheranalytics.com/static/ltm/ma23578/wp/27/
Redirect Chain

https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1642
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js

150 KB
43 KB

34ms
33ms

Script
application/x-javascript

107.178.250.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 107.178.250.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 04:38:06 GMT
content-encoding: br
via: 1.1 google
last-modified: Mon, 12 Jun 2023 20:29:05 GMT
server: nginx
age: 82864
etag: "85aef1250c3704a499337dcfc565d621"
vary: Accept-Encoding
x-cache: HIT Mon, 12 Jun 2023 20:39:07 GMT
content-type: application/x-javascript
cache-control: public,max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44324

Redirect headers

date: Wed, 13 Dec 2023 03:39:10 GMT
via: 1.1 google
server: nginx
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
cache-control: public, max-age=269200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-served-by: 7-gc-useast1-22ng1032

GET
H2 200 21aa21d21fd72f69abc559671d416169 Show response
a869.mercurynews.com/plugin/plugin/ 229 KB
55 KB 68ms
67ms Script
text/javascript 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/plugin/plugin/21aa21d21fd72f69abc559671d416169

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-234-28-111.compute-1.amazonaws.com

Software

- /

Resource Hash

55ffad99662a861f598a5ab8ef254c53f720a256eb4c8d57e96aba81e5e00fe8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
age: 6035465
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 55297
x-xss-protection: 1; mode=block
last-modified: Tue, 03 Oct 2023 07:08:05 GMT
server: -
etag: 21aa21d21fd72f69abc559671d416169
content-type: text/javascript; charset=utf-8
cache-control: public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag: noindex, nofollow
x-amz-cf-id: UlIfAP1k1y5A0G8l86zcLMas2Z-SugJe1vr9QizKSkc5nuvH98iQ8A==
expires: Thu, 03 Oct 2024 07:08:05 GMT

GET
H2 200 self Show response
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 629 B
798 B 175ms
88ms XHR
application/json 104.26.5.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1702438750745
Requested by: Host: cdn.mircheigeshoa.com
URL: https://cdn.mircheigeshoa.com/prod/dfm/fp.min.js?20231112
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.5.15 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e15bd1add7a9ea1d283666461d3cc2d2fd5fd6b356eacd7c8246eae5600c9eb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 13 Dec 2023 03:39:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XU96VnBdA1WxnWest48EwZ5sxOrgGaTW8vG1NrqMsjMFvP5cL7EXqU9MKZf%2FEH8gHZunEcL9wbn5SN6R%2FDSdc8j0YJWfuTaKbGXM5Zd9fg13Y%2FE40G6zIXOkdTm%2FY%2Bwj2Pnu"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=1800
cf-ray: 834b2db0dfc874be-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 200 t Show response
jadserve.postrelease.com/ 4 KB
2 KB 289ms
67ms Script
text/javascript 52.72.239.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&ntv_mvi&us_privacy=1-N-
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.239.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-239-79.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 4e49e0d519938f5038f6cd9a1fbea0b03c3042a31e583d6b3a9bbc0c49384329

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
server: nginx
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 1691
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 rules-p-4ctCQwtnNBNs2.js Show response
rules.quantcount.com/ 3 B
447 B 269ms
72ms Script
application/javascript 2600:9000:26a0:fc00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-4ctCQwtnNBNs2.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26a0:fc00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:16:07 GMT
via: 1.1 b00903dd6c0e35a04eab89fc03a8023e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P2
age: 1385
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:57:14 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: mZ038wQyLDvAmlCzZ8zJPEcH0Cw7-SF3fV9Z1DJ0hVvO8dA1OPuvTg==

GET
H2 200 FUtg69tL.js Show response
cdn.jwplayer.com/libraries/ Frame 95A6 108 KB
41 KB 254ms
73ms Script
text/javascript 2600:9000:2209:ea00:1:a3fa:7cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jwplayer.com/libraries/FUtg69tL.js
Requested by: Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2209:ea00:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: 498a1dee1e485694752427edd06327b13d28ed5fa89a6f17946104a7322748fe

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:38:20 GMT
content-encoding: gzip
via: 1.1 b8d8693cc4ac05b6a9cebe2651a2c8b8.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: EWR53-P1
age: 51
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=180
x-robots-tag: noindex, indexifembedded
content-length: 41174
x-amz-cf-id: amMxOVMF4F_PBuXT9p00jmPRhdHOlL1Yhmfh58zAjb3xRq0jp2FlCg==

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame C356
Redirect Chain

https://dpm.demdex.net/ibs:dpid=82530&dpuuid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=

42 B
714 B

62ms
61ms

Image
image/gif

34.234.28.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Server

34.234.28.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

dcs: dcs-prod-va6-1-v053-0f0ef86cd.edge-va6.demdex.com 3 ms
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: 1DmdN6HRQ3g=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-va6-1-v053-0fcf68780.edge-va6.demdex.com 0 ms
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: M0/SK28ISJc=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame C356
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553

95 B
427 B

62ms
61ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

date: Wed, 13 Dec 2023 03:39:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

pixel.gif
load77.exelator.com/ Frame C356
Redirect Chain

https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=&xl8blockcheck=1
https://load77.exelator.com/pixel.gif

43 B
385 B

283ms
66ms

Image
image/gif

2a02:6ea0:c400::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://load77.exelator.com/pixel.gif
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 2a02:6ea0:c400::11 New York, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-77-pop: newyorkUSNY
date: Wed, 13 Dec 2023 03:39:11 GMT
x-age-lb: 581056
x-77-cache: HIT
x-accel-date: 1701857695
content-length: 43
x-77-nzt: EQwBnJIkFgH3wN0IAA
x-accel-expires: @1702894495
x-77-age: 581056
x-cache-lb: HIT
last-modified: Wed, 25 Oct 2017 17:03:56 GMT
server: CDN77-Turbo
etag: "59f0c3fc-2b"
x-77-nzt-ray: 1e192d08069d871e5f277965dbecb623
content-type: image/gif
access-control-allow-origin: *
accept-ranges: bytes

Redirect headers

date: Wed, 13 Dec 2023 03:39:11 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://load77.exelator.com/pixel.gif
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H2 200 384136.gif
idsync.rlcdn.com/ Frame C356 42 B
439 B 172ms
74ms Image
image/gif 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/384136.gif?partner_uid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2

200

qmap
sync.crwdcntrl.net/ Frame C356
Redirect Chain

https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=&ct=y

49 B
740 B

72ms
69ms

Image
image/gif

54.209.94.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=&ct=y
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 54.209.94.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-94-68.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.53.240
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=&ct=y
cache-control: no-cache
x-server: 10.40.5.136
content-length: 0
expires: 0

GET
H2 200 sync Show response
gum.criteo.com/ 46 B
288 B 179ms
58ms Script
text/javascript 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS&us_privacy=1-N-&gdpr=0&gdpr_consent=&gdpr_pd=

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:10 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 250731
expires: 60

GET
H2 200 json Show response
trc.taboola.com/medianewsgroup-mercurynews/trc/3/ 171 KB
53 KB 724ms
710ms XHR
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/medianewsgroup-mercurynews/trc/3/json?tim=17%3A39%3A10.952&lti=deflated&data=%7B%22id%22%3A100%2C%22ii%22%3A%22%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1702400841313%2C%22vi%22%3A1702438750949%2C%22cv%22%3A%2220231212-21-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F%22%2C%22bv%22%3A%220%22%2C%22wc%22%3Atrue%2C%22ul%22%3A%5B%22en-US%22%2C%22en%22%5D%2C%22uad%22%3A%7B%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D%2C%22cmps%22%3A0%2C%22ga%22%3Afalse%2C%22ccpa_ps%22%3A%221-N-%22%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bu%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F%22%2C%22vpi%22%3A%22%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A5714%2C%22nsid%22%3A%22medianewsgroup-network%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A6%2C%22uim%22%3A%22thumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22cd%22%3A2491.46875%2C%22mw%22%3A954.875%7D%5D%2C%22cacheKey%22%3A%22text%3D%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2CBelow%20Article%20Thumbnails%3Dthumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D&llvl=2
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20231212-21-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: bbf7651ee89f1602407d49f7d23a7fae18f196f73c94c3a7dd1e9205ab6249f2

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

x-vcl-time-ms: 673
date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
via: 1.1 varnish
cpu: 0.42083333333333334
x-fastly-to-nlb-rtt: 30021
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-mia-kmia1760053-MIA
x-log-content-encoding: gzip
server: nginx
x-timer: S1702438751.986061,VS0,VE673
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 launchpad.bundle.js Show response
launchpad.privacymanager.io/latest/ 126 KB
26 KB 214ms
68ms Script
application/x-javascript 18.164.116.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.116.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-116-107.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 10ca218fc957f3b1b7f8f0a0f6bab1c8b384ed7d6edda052614bf8cc9c14eac2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: OYXhO0yAI32wYHLbaFkvb4YycLXHk8gH
content-encoding: br
via: 1.1 c38cfac20df9757e670e782ca61768aa.cloudfront.net (CloudFront)
date: Wed, 13 Dec 2023 03:01:28 GMT
last-modified: Tue, 12 Dec 2023 13:01:22 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P6
age: 2263
x-amz-server-side-encryption: AES256
etag: W/"6f5acc886b373331d622309f643f2f89"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: must-revalidate,public,max-age=3600
x-amz-cf-id: 7f9x_sgS66lrr_rrYSZ226hNtVKxEaPd1sA1AmWYcHSeBKMlCyfS7w==

GET
H3

200

dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=;uab=;uafvl=;... Show response
13619678.fls.doubleclick.net/ddm/fls/r/ Frame A201
Redirect Chain

https://adservice.google.com/ddm/fls/i/dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1...
https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gc...

942 B
405 B

108ms
108ms

Document
text/html

172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F

Requested by

Host: 13619678.fls.doubleclick.net
URL: https://13619678.fls.doubleclick.net/activityi;dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

cafe /

Resource Hash

96d067a62e031eaeb42ae6167873eba6e96521f776bffb908641c053d69d4918

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13619678.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 380
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 13 Dec 2023 03:39:11 GMT
expires: Wed, 13 Dec 2023 03:39:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 13 Dec 2023 03:39:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 load.js Show response
pm-widget.taboola.com/medianewsgroup-network/ 3 KB
1 KB 38ms
35ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pm-widget.taboola.com/medianewsgroup-network/load.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a2ce40a146a5e73e3a20e3c0d6dfc53691af0c4819d42495f4c2f202469fe30

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: GO2uBrVNpV6SeEfay8sXHwrzdV13xhY3
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:11 GMT
x-amz-request-id: TZ6BDNHB075F5VS2
age: 2533
x-cache: HIT
content-length: 1084
x-amz-id-2: grILtKpcUHxumGdsTmJnRuAEvFRmXHUT8ns/Mg7W3YlAHC3kvyfwdT3avWr3aqbMJaI7FYS2voU=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Fri, 29 Sep 2023 08:29:58 GMT
server: AmazonS3
x-timer: S1702438751.044290,VS0,VE0
etag: "9acdca0188f27ced9dc61b5734fcfb38"
vary: Accept-Encoding,
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-cache-hits: 7

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2c95bbac8e167a1fd9297768d9c45d1f50db54733b750ae889b3a5efd2fae8fa

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
BLOB 200
OK 0176f1bb-c499-48a5-a770-b8c7b52dbf77
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/0176f1bb-c499-48a5-a770-b8c7b52dbf77
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 1900c85bc7d55fd9d1a3d33f55cea3b9 Show response
a869.mercurynews.com/plugin/library/ 348 KB
107 KB 69ms
67ms Script
text/javascript 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/plugin/library/1900c85bc7d55fd9d1a3d33f55cea3b9

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

58d551810fa8e832a61b7cecb4a7aaefaa11544fcf37b050ad645e6428c83f69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 28 Sep 2023 14:44:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
age: 6526490
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 109366
x-xss-protection: 1; mode=block
last-modified: Wed, 27 Sep 2023 14:44:21 GMT
server: -
etag: 1900c85bc7d55fd9d1a3d33f55cea3b9
content-type: text/javascript; charset=utf-8
cache-control: public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag: noindex, nofollow
x-amz-cf-id: YvxDCxkP8Gho--OH-WiIwdpT0Dcj8_ik3RXUVN7qBFc2rfjnE58c9Q==
expires: Fri, 27 Sep 2024 14:44:21 GMT

POST
H2 200 LB-Zone-3 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/155/ 3 KB
2 KB 112ms
106ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155/LB-Zone-3?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=&bctempid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&overruleReferrer=&time=2023-12-12T17%3A39%3A11-10%3A00&ts=1702438751083

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-6-88-177.compute-1.amazonaws.com

Software

- /

Resource Hash

d9da8ead452901e8ea37bdff6aa95fc258d0a50c82a4a084c1f3eb4b4188341a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 987
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: tAZfQbS0ohc61_17F5xG2i9LmkBb0tDsoEBg7DtyYKAj5aBJY9Huuw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
257 B 127ms
46ms Ping
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-LMTT1ZNHB1&gtm=45je3bt0v9105985080z871194413&_p=1702438749746&_gaz=1&gcs=G1--&gcd=11l1l1l1l5&dma=0&tcfd=10000&cid=1754874842.1702438751&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1702438751&sct=1&seg=0&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&dt=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&tfd=2072
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
257 B 193ms
67ms Ping
text/plain 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-LMTT1ZNHB1&cid=1754874842.1702438751&gtm=45je3bt0v9105985080z871194413&aip=1&dma=0&gcs=G1--&gcd=11l1l1l1l5
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::9d Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1702438751137&aid=a-04i4&se=e30&duid=f107d3ac6b63--01hhgm3jp4b3510ykvt3etkph9&tna=v2.11.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-fro...
https://rp4.liadm.com/j?se=e30&aid=a-04i4&tna=v2.11.2&dtstmp=1702438751137&wpn=lc-bundle&gpp_as=6&duid=f107d3ac6b63--01hhgm3jp4b3510ykvt3etkph9&gdpr=0&n3pc=true&gpp_s=DBACOe~CP2uYgAP2uYgAEXeBAENDeE...

48 B
353 B

310ms
64ms

XHR
application/json

44.198.227.25
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?se=e30&aid=a-04i4&tna=v2.11.2&dtstmp=1702438751137&wpn=lc-bundle&gpp_as=6&duid=f107d3ac6b63--01hhgm3jp4b3510ykvt3etkph9&gdpr=0&n3pc=true&gpp_s=DBACOe~CP2uYgAP2uYgAEXeBAENDeEwAP_gAEPgACiQGgwFQAFAANAAyABwAEAAJAAaAA9ACgAFsANAAhIBHAEeAKQAVoBAACDgKiAXmAxkBoIF5wCgAMgAcABAADQANAAhABHAEAAIOAvMAAAA~BP2uYgAP2uYgAEXeBAENDeCgAf_AAIfAAAaDAVAAUAA0ADIAHAAQAAkABoAD0AKAAWwA0ACEgEcAR4ApABWgEAAIOAqIBeYDGQGggXnAKAAyABwAEAANAA0ACEAEcAQAAg4C8w~1-N-&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&c=PHRpdGxlPlJ1c3NpYW4gbWFuIGZsaWVzIGZyb20gRGVubWFyay1MQVggd2l0aCBubyB0aWNrZXQsIHBhc3Nwb3J0PC90aXRsZT48bWV0YSBuYW1lPSJkZXNjcmlwdGlvbiIgY29udGVudD0iSGUgdG9sZCBvZmZpY2lhbHMgaGUgbWlnaHQgaGF2ZSBoYWQgYSBwbGFuZSB0aWNrZXQgdG8gY29tZSB0byB0aGUgVW5pdGVkIFN0YXRlcywgYnV0IGhlIHdhcyBub3Qgc3VyZS4gSGUgYWxzbyBzYWlkIGhlIGRpZG4ndCByZW1lbWJlciBob3cgaGUgZ290IHRocm91Z2ggc2VjdXJpdHkgaW4gQ29wZW5oYWdlbiBhbmQgd291bGRuJ3QgZXhwbGFpbiB3aGF0IGhlIHdhcyBkb2luZyBpbiB0aGUgU2NhbmRpbmF2aWFuIGNpdHksIGFjY29yZGluZyB0byB0aGUgY29tcGxhaW50LiI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzEyLzEyL3J1c3NpYW4tbWFuLWZsaWVzLWZyb20tZGVubWFyay10by1sYXgtd2l0aC1uby10aWNrZXQtb3ItcGFzc3BvcnQvIj48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS9uZXdzL3dvcmxkLW5ld3MvIj5Xb3JsZCBOZXdzIHwgPC9hPjwvZGl2PgkKCQkJCTxzcGFuIGNsYXNzPSJkZm0tdGl0bGUgZnJlZSI-CgkJCVJ1c3NpYW4gbWFuIGZsaWVzIGZyb20gRGVubWFyayB0byBMQVggd2l0aCBubyB0aWNrZXQgb3IgcGFzc3BvcnQJCTwvc3Bhbj4KCgkKCTwvaDE-&i6=MjAwMTo1NTA6MWQwNToxOjoz&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 44.198.227.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-198-227-25.compute-1.amazonaws.com
Software: /
Resource Hash: db1be639c6bb1d11edb8c716a629847c3e0f5492de69797d3619b34ddd34e878

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
x-pixel-event-id: b4947380-42ab-493a-aff1-6e57d29577d7
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: null
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 48

Redirect headers

location: https://rp4.liadm.com/j?se=e30&aid=a-04i4&tna=v2.11.2&dtstmp=1702438751137&wpn=lc-bundle&gpp_as=6&duid=f107d3ac6b63--01hhgm3jp4b3510ykvt3etkph9&gdpr=0&n3pc=true&gpp_s=DBACOe~CP2uYgAP2uYgAEXeBAENDeEwAP_gAEPgACiQGgwFQAFAANAAyABwAEAAJAAaAA9ACgAFsANAAhIBHAEeAKQAVoBAACDgKiAXmAxkBoIF5wCgAMgAcABAADQANAAhABHAEAAIOAvMAAAA~BP2uYgAP2uYgAEXeBAENDeCgAf_AAIfAAAaDAVAAUAA0ADIAHAAQAAkABoAD0AKAAWwA0ACEgEcAR4ApABWgEAAIOAqIBeYDGQGggXnAKAAyABwAEAANAA0ACEAEcAQAAg4C8w~1-N-&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&c=PHRpdGxlPlJ1c3NpYW4gbWFuIGZsaWVzIGZyb20gRGVubWFyay1MQVggd2l0aCBubyB0aWNrZXQsIHBhc3Nwb3J0PC90aXRsZT48bWV0YSBuYW1lPSJkZXNjcmlwdGlvbiIgY29udGVudD0iSGUgdG9sZCBvZmZpY2lhbHMgaGUgbWlnaHQgaGF2ZSBoYWQgYSBwbGFuZSB0aWNrZXQgdG8gY29tZSB0byB0aGUgVW5pdGVkIFN0YXRlcywgYnV0IGhlIHdhcyBub3Qgc3VyZS4gSGUgYWxzbyBzYWlkIGhlIGRpZG4ndCByZW1lbWJlciBob3cgaGUgZ290IHRocm91Z2ggc2VjdXJpdHkgaW4gQ29wZW5oYWdlbiBhbmQgd291bGRuJ3QgZXhwbGFpbiB3aGF0IGhlIHdhcyBkb2luZyBpbiB0aGUgU2NhbmRpbmF2aWFuIGNpdHksIGFjY29yZGluZyB0byB0aGUgY29tcGxhaW50LiI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzEyLzEyL3J1c3NpYW4tbWFuLWZsaWVzLWZyb20tZGVubWFyay10by1sYXgtd2l0aC1uby10aWNrZXQtb3ItcGFzc3BvcnQvIj48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS9uZXdzL3dvcmxkLW5ld3MvIj5Xb3JsZCBOZXdzIHwgPC9hPjwvZGl2PgkKCQkJCTxzcGFuIGNsYXNzPSJkZm0tdGl0bGUgZnJlZSI-CgkJCVJ1c3NpYW4gbWFuIGZsaWVzIGZyb20gRGVubWFyayB0byBMQVggd2l0aCBubyB0aWNrZXQgb3IgcGFzc3BvcnQJCTwvc3Bhbj4KCgkKCTwvaDE-&i6=MjAwMTo1NTA6MWQwNToxOjoz&us_privacy=1-N-
access-control-allow-origin: https://www.mercurynews.com
date: Wed, 13 Dec 2023 03:39:11 GMT
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET

GET
BLOB 200
OK 4a762d55-eae0-4c67-bc50-da8516fbd602
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/4a762d55-eae0-4c67-bc50-da8516fbd602
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 b-34df212-ae6f9fe2.js Show response
tagan.adlightning.com/mng-trib/ 68 KB
27 KB 88ms
87ms Script
application/javascript 3.161.213.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-54.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2a287439d841968fbb9edca3c80d9acc3b66897fd273a501ef8588461f8c1cd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 23:09:24 GMT
content-encoding: gzip
via: 1.1 82411d437ee2d2355a407b78473e6156.cloudfront.net (CloudFront)
x-amz-version-id: HDL2ZIRuJOCDdiq95fmqqTRa5yG_hp7B
x-amz-cf-pop: YUL62-P1
age: 1657788
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 26671
x-amz-meta-git_commit: 34df212
last-modified: Thu, 16 Nov 2023 21:29:58 GMT
server: AmazonS3
etag: "56f253d067322ed6ec468752a24f24d0"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: NOp8trenQFWT5kw2K9Bqg0I3W9IDu0TQ82w73_PeMpR8HlUReV3lGQ==

GET
H2 200 bl-552b890-26dbe4fd.js Show response
tagan.adlightning.com/mng-trib/ 74 KB
32 KB 150ms
149ms Script
application/javascript 3.161.213.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/mng-trib/bl-552b890-26dbe4fd.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-54.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 140fe7b69c1a582786ee4cc0ee1ea5f3c5c82b28ee6934088d46ea87990afd00

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 19:41:35 GMT
content-encoding: gzip
via: 1.1 82411d437ee2d2355a407b78473e6156.cloudfront.net (CloudFront)
x-amz-version-id: yEbUQEjUY8cxQeObC..0yi19tSubwMEp
x-amz-cf-pop: YUL62-P1
age: 28657
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31784
x-amz-meta-git_commit: 552b890
last-modified: Tue, 12 Dec 2023 19:32:19 GMT
server: AmazonS3
etag: "c745c3401d2842d68f63d7778e75600a"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 0AdZBjIaDJ9T9ff_dc1J7VKRZqnFK8hhpqVhPczRQkeu3rZcbl0Y_g==

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/ 431 KB
135 KB 75ms
73ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js?cb=31080056

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

108cdb682e1d256ba58174d96775ec12fe2e9515ffa2ca7edfff49343a4d97ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 11:37:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57731
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138180
x-xss-protection: 0
server: cafe
etag: 6854214708762155125
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 11 Dec 2024 11:37:00 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 182ms
63ms XHR
application/javascript 18.238.64.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.64.130 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-64-130.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 06:07:24 GMT
x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 590897dc65a5ea6dcbac1c8ea98c65c4.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 77508
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: dtarSukDF1F2BPcHnDbp3Sgx2cKYoy7YB2SqolEkOPgvjmG_imfPRg==

GET
H2 200 tag Show response
s.thebrighttag.com/ 0
267 B 302ms
82ms Script
text/javascript 3.20.157.202
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.thebrighttag.com/tag?site=t4tmU86&H=7ookpev
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.20.157.202 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-20-157-202.us-east-2.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
x-bt-requestid: 2deebae0-9969-11ee-9cda-0000ac17031e
server: nginx
etag: d41d8cd98f00b204e9800998ecf8427e
content-type: text/javascript
access-control-allow-origin: https://www.mercurynews.com
p3p: CP=NOI DSP COR NID
cache-control: private, must-revalidate
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 480ms
57ms Image
image/gif 54.198.156.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&artid=10256073&artpubt=1702431291&artsrc=no_affiliation&arttype=free&artupt=1702431291&auth=The%20Associated%20Press&chrcnt=2627&cms=WP&hier=World%20News%7CNews&ptype=article&pubname=The%20Mercury%20News&sec=World%20News&wrdcnt=424&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Pacific%2FHonolulu&tzoff=600&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=7a7758fb-6460-4363-b920-dc28b3793d37&pid=b95fdc8e-6db9-4524-86e6-2fed99ef0217&dtm=1702438751430&qnm=_matherq&visible=1&tabid=20d6cd17-3152-45e1-a085-1e4a77a1cb60&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&vp=1600x1200&ds=4000x5065&tofa=1702438751&vid=1&lvidt=1702438751&duid=efb485d2-e5b6-4b64-b1da-6f3c1f491b10&fp=1905609432&cid=ma23578&mrk=239876506&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTcwMjQzODc0OTA2MCIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIzNy4zbWIiLCJoZWFwVCI6IjU2LjhtYiIsImZzdFBhaW50IjoiNzc2IiwiZmV0Y2hTIjoiMCIsImRvbWFpblMiOiI5IiwiZG9tYWluRSI6IjkiLCJjb25uUyI6IjkiLCJjb25uRSI6Ijc3Iiwic3NsUyI6IjQwIiwicmVxdVMiOiI3NyIsInJlc3BTIjoiMTA5IiwicmVzcEUiOiIxNTYiLCJkb21Mb2FkIjoiMTEzIiwiZG9tSW50ZXIiOiI5NzgiLCJkb21Mb2FkUyI6Ijk4OCIsImRvbUxvYWRFIjoiMTAwMiJ9LCJrZXl3b3JkcyI6WyJSdXNzaWEiLCJEZW5tYXJrIiwiQ29wZW5oYWdlbiIsInN0b3dhd2F5IiwiZmVkZXJhbCBjaGFyZ2VzIl0sImlkZW50aXRpZXMiOlt7InR5cGUiOiJnYSIsImlkIjoiMTc1NDg3NDg0MiIsInJlZlRpbWUiOiIxNzAyNDM4NzUxNDI5In1dLCJjYXRlZ29yeSI6eyJjYXRlZ29yaWVzIjpbWyJXb3JsZCBOZXdzIiwiTmV3cyJdXX0sImF1dGgwX3N1YiI6IiIsImF1ZGllbmNlIjpbeyJwcm92aWRlciI6InVzZXJEQiIsInNlZ21lbnRzIjpbIk1BVEhFUl9VOV9JTlNUQU5UQV8yMDIwMDIwMyJdLCJwYWdlSWQiOiJiOTVmZGM4ZS02ZGI5LTQ1MjQtODZlNi0yZmVkOTllZjAyMTcifSx7InByb3ZpZGVyIjoiaVNlZ3MiLCJzZWdtZW50cyI6WyJNQVRIRVJfVTlfSU5TVEFOVEFfMjAyMDAyMDMiXSwicGFnZUlkIjoiYjk1ZmRjOGUtNmRiOS00NTI0LTg2ZTYtMmZlZDk5ZWYwMjE3In1dfQ
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.156.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-156-105.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Wed, 13 Dec 2023 03:39:11 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 css2
fonts.googleapis.com/ Frame 95A6 3 KB
624 B 97ms
96ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

933ff38629199ba200d23e1a3afda3ca9cae06352169926a4609942ab4d3742b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:55:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 13 Dec 2023 03:39:11 GMT

GET
H2 200 ping.gif
player-files.remixd.com/ Frame 95A6 43 B
183 B 250ms
163ms Image
image/gif 35.190.38.143
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://player-files.remixd.com/ping.gif?action=playerImpression&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=0&sessionId=ca0f6217-68d7-4086-9bda-749940c1dba6&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 143.38.190.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
x-guploader-uploadid: ABPtcPpNqwJrHqR-P5a3dM1G3Bnr0iMCIxKKOjXVEh5x_uzejRH3Rw6uQ8MmpYa-QMlaUKFXpAFfje9tcJBzfkLMaQPqUw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Wed, 23 Oct 2019 15:45:02 GMT
server: UploadServer
etag: "cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation: 1571845502045744
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers: Content-Type
cache-control: no-cache, no-store, must-revalidate
x-goog-stored-content-length: 43
accept-ranges: bytes
expires: Thu, 12 Dec 2024 03:39:11 GMT

GET
H2 200 ping.gif
player-files.remixd.com/ Frame 95A6 43 B
195 B 211ms
124ms Image
image/gif 35.190.38.143
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://player-files.remixd.com/ping.gif?action=loading&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=1&sessionId=ca0f6217-68d7-4086-9bda-749940c1dba6&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 143.38.190.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
x-guploader-uploadid: ABPtcPq623YFgdrt9o3F6DxJumxli4zN-WxVAEnesQ05wr8I-Bx_ReHCsm6DsrBY0-2ZEy0yqwcmiICkG9elcgUZigAS1itYsfIR
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Wed, 23 Oct 2019 15:45:02 GMT
server: UploadServer
etag: "cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation: 1571845502045744
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers: Content-Type
cache-control: no-cache, no-store, must-revalidate
x-goog-stored-content-length: 43
accept-ranges: bytes
expires: Thu, 12 Dec 2024 03:39:11 GMT

GET
H2 200 ping.gif
player-files.remixd.com/ Frame 95A6 43 B
573 B 169ms
82ms Image
image/gif 35.190.38.143
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://player-files.remixd.com/ping.gif?action=loaded&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=2&sessionId=ca0f6217-68d7-4086-9bda-749940c1dba6&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 143.38.190.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
x-guploader-uploadid: ABPtcPrv_va8iBmCMj4-22QdVAqILb3gYIue4H5Tw5vuMF-GZ0sZ6IN1OvMEnsZPpj7m07Pt3a03L0VEcN_CQW2mz_BkzQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Wed, 23 Oct 2019 15:45:02 GMT
server: UploadServer
etag: "cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation: 1571845502045744
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers: Content-Type
cache-control: no-cache, no-store, must-revalidate
x-goog-stored-content-length: 43
accept-ranges: bytes
expires: Thu, 12 Dec 2024 03:39:11 GMT

GET
BLOB 200
OK bc1e9ad8-a2b3-4994-ac6f-8b0434fe0d1e
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/bc1e9ad8-a2b3-4994-ac6f-8b0434fe0d1e
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 up.js Show response
cdn01.basis.net/assets/ Frame A201 3 KB
2 KB 284ms
63ms Script
application/javascript 69.164.46.3
LLNW

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn01.basis.net/assets/up.js?um=1
Requested by: Host: 13619678.fls.doubleclick.net
URL: https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.164.46.3 New York, United States, ASN22822 (LLNW, US),
Reverse DNS: https-69-164-46-3.jfk.llnw.net
Software: AC1.1 /
Resource Hash: 25b33a7a853f39e447b14be3e6662ccbb0fbce73620bf7778d194cb3fef1d3ab

Request headers

accept-language: en-US,en;q=0.9
Referer: https://13619678.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
last-modified: Wed, 16 Mar 2022 16:22:21 GMT
server: AC1.1
age: 207212
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1550
x-llid: 4e266cd316e5f179790ad10ff0724c16

GET
H2 200 cs Show response
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 66 B
855 B 62ms
61ms Script
text/javascript 52.6.88.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&&callback=bc_json158

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.6.88.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

- /

Resource Hash

56395748e439ff72626ba66e7d9909a8ea6eb2f6a714b3170307fec5da7dfcab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: -
x-permitted-cross-domain-policies: master-only
content-type: text/javascript; charset=utf-8
p3p: policyref="", CP="DSP"
cache-control: no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag: noindex, nofollow
content-length: 84
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 trk.gif
jadserve.postrelease.com/ 43 B
618 B 61ms
60ms Image
image/gif 52.72.239.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_at=394&ntv_usid=5940638&ntv_pl=1028524
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.239.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-239-79.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 trk.gif
jadserve.postrelease.com/ 43 B
618 B 62ms
61ms Image
image/gif 52.72.239.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_ui=d45c3540-f1c8-47b5-889b-9ddee59369e3&ntv_fl=w17_ozdxaJTnNoCtXGccc1C64zbwUBVS35TS0mkW_Dke2CoUAd7m6pKTAPlSanH8P6Ftm4pT6SFcPVt1Er5smLG_LP7t-3iI8CNeWkubHPMsee8usxoc2-vQjvLIcUBfHdmD20yIkUqo2zcuH2dltsYvAyzlLh2dDJRxbZSv8I7vJueRfDUAPIRzL3iFRdNcnjm6FlCCDrQn0BMOWxc4M0HP_PPfdrh6oQdsjsV4yp9ob5YkAQb8ESFYKu6NA1oP0VEIi84j9YArIm26jvcKrgyhRCAlHElZ0d9tWOzf1EnFFV-n8E1xMgsXFLm8u5Ev9obiOvU0gSw9zSYbza8pJYxFt3t0-R0k_5sTRLm1I1RppfCg2mGpF95ZQaRAgmUVS_YQRngv4NLjudwl2CDoots5Y7P7nFZ5sTdBoeUy8fYjPRFu2RqsOMlU07WKUzeQbCNhJTW-d8QSH6SHnLakLrm8y0RaZ_5wjo5PINPn1J_dGwDjfz0CLQCMx57Kdas-AYyIt78Yu8NGaAQT9DLn4wsiI2zPhas3hV37grc0nzO92I9kMDDAiFFcVtGIZc5paBvU6sysuJh-fk6zqNASuA==&ntv_ht=Xyd5ZQA&ntv_at=303,302&ntv_a=AAAAAAAAAArLEPA&ord=1702438751600&ntv_it
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.239.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-239-79.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 trk.gif
jadserve.postrelease.com/ 43 B
618 B 63ms
62ms Image
image/gif 52.72.239.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_ui=15b2599d-4451-49a1-a5a3-249ffee1e031&ntv_fl=DOoEcgB0BB04DrHgiFrFsFF-lFdjD84Is_FOo9090IWMVn5KZZ5BoZndpKPJlwt-5pvxeWSiK7VJWruW9Vyi-aGvuD2finXGtNwpaPlne6zdwS3kKe1fmtxIEnFgO82YEWcCfJWHwJcr2arcQWQBANxN0psQHHiAONUaPxX-39IQ08D7j6dew-mYsbCFQrXqr70yXhAVHU09pZ4ZqiJE5LJPajD5aF6h4E3zRDQEynJ-0NBHGJZIYQKNS6r43qtNSnVHq6Iv7GZK9NvXVzoxY2M1yiIgXyJA4A5Smt80QsmiIq9Fui5XiUtFx-QEwd3JMgcl3tHFGfOu4Ww3RbC3RP58UZkN3fBHfNCnbYlDORgeOAOQMvymaqwBQ39Bvd-W3zedfdbeaBYZG6UyvDuxpbjqH_j_eBBTNTL2KYw_a1vcl_AFCUvRR-5dzrfTYew16_zBxEvrEOt8RRgZsZESomNMXpMBkTpb33Vr7mA_y5WL0iWfthqdjDQxqug7IlNYdjeuAKySbCtPQOjy8LAjRWvizXsX44D13pEm7dW3tLpRl1lo1JBPfUGlrdz6I4Sro2p9-Fx2YJ3tK9zIIOwI1g==&ntv_ht=Xyd5ZQA&ntv_at=303&ntv_a=AAAAAAAAAAjRcRA&ord=1702438751604&ntv_it
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.239.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-239-79.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 pmk-20220605.4.js Show response
pm-widget.taboola.com/medianewsgroup-network/ 102 KB
29 KB 230ms
33ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pm-widget.taboola.com/medianewsgroup-network/pmk-20220605.4.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 159aae4fa7197b58e4aa459e76dac1dde612b1d774be5b7f6191cf4386bf8f21

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: mn0GdbXCcgrWsiMpc99j15X7VjSvjRU8
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:11 GMT
x-amz-request-id: DGXPF32FGBXWYS8N
age: 1029341
x-cache: HIT
content-length: 28801
x-amz-id-2: Np46nijbbqrErAWULIwa0cGMt3v7H1FbggdA17I0B4uVLfVYf7l0cIpBeGOlP37h7DePeIhBpDY=
x-served-by: cache-mia-kmia1760049-MIA
last-modified: Fri, 29 Sep 2023 08:29:58 GMT
server: AmazonS3
x-timer: S1702438752.829709,VS0,VE0
etag: "528e03e001c20efe0a751bb779b986e2"
vary: Accept-Encoding, ,Origin
access-control-allow-methods: GET,POST,PUT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 15

GET
H2 200 card-interference-detector.20231212-21-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 5 KB
3 KB 33ms
32ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/card-interference-detector.20231212-21-RELEASE.es6.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 337de586a5f034a6f2f314d95b5802497af444a23a4802ff3348b6f7df99768b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: 1nRCzLIVTROY8U.ozN_U3U_mUoCqbt_D
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:11 GMT
x-amz-request-id: SXY5D0GA0NNQ3CH2
age: 43110
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 2180
x-amz-id-2: eO2gRoK1x4bCbVh7soSPhLyr6x/gHpk2Xf6Fz531kTZLS9Hb41YafCGAX3vaIAUHx5Z5e1bz4IQ=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 14:40:39 GMT
server: AmazonS3
x-timer: S1702438752.634386,VS0,VE0
etag: "34426a35d76853c446cc8152c7745ecd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 47
access-control-allow-origin: *
cache-control: private,max-age=2629743
accept-ranges: bytes
x-cache-hits: 12678

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/ 2 KB
1 KB 101ms
100ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1702438750995&cv=11&fst=1702438750995&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v898332463&gcd=11l1l1l1l5&dma=0&tcfd=10000&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&hn=www.googleadservices.com&frm=0&tiba=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&us_privacy=1-N-&auid=1602369993.1702438750&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ffc636aba5054ba215880665960cd9b9ca1a9b6fe9ca0f7da96a17753241c813

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1348
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ Frame 95A6 20 KB
20 KB 75ms
74ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:56:44 GMT
x-content-type-options: nosniff
age: 495747
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20960
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:18:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 09:56:44 GMT

GET
H3 200 7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v12/ Frame 95A6 21 KB
21 KB 85ms
83ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs5.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 10:00:04 GMT
x-content-type-options: nosniff
age: 495547
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21144
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:43:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 10:00:04 GMT

GET
H/1.1 200
OK 1x1-pixel.png
ams-pageview-public.s3.amazonaws.com/ 68 B
448 B 248ms
71ms Image
image/png 54.231.226.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ams-pageview-public.s3.amazonaws.com/1x1-pixel.png?id=1a461e4fcca4
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.231.226.9 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:12 GMT
Last-Modified: Mon, 26 Oct 2020 16:52:19 GMT
Server: AmazonS3
x-amz-request-id: NADDTSTEQVTXTQXM
ETag: "91e42db1c66c0b276abf6234dc50b2eb"
Content-Type: image/png
Cache-Control: no-store
Accept-Ranges: bytes
Content-Length: 68
x-amz-id-2: UUm22COxyLjxUjm209VykvK5m7p5kUg+bI7clL/IhRljlvR1rM6/N5T8Bfc73kgCBlRnm7e/FP0=

GET
BLOB 200
OK ff9338a8-ba1f-45ac-98c6-566297d9c07a
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/ff9338a8-ba1f-45ac-98c6-566297d9c07a
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 / Show response
geo.privacymanager.io/ 30 B
608 B 75ms
75ms Fetch
application/json 3.161.213.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: launchpad.privacymanager.io
URL: https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-79.yul62.r.cloudfront.net
Software: /
Resource Hash: b94047a885ec91143818ebb76251e206a303a492429f67defc1c2e46c10c41c9

Request headers

Accept: application/json
Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:30:53 GMT
via: 1.1 b052b62106bf04b3d8195399a6b77186.cloudfront.net (CloudFront), 1.1 4abd8708c8464a6586e6829348c23522.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD61-P2, YUL62-P1
age: 68899
x-amzn-requestid: 3d3a6857-82d4-4fd8-ae5c-a7daab6cf157
x-amzn-trace-id: Root=1-65781a3d-302de651124edc9e7102e3c6;Sampled=0;lineage=06620786:0
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-apigw-id: P0kJoFDHjoEEoCQ=
content-length: 30
x-amz-cf-id: NqcoUT7jqoIm9nMycKHaVzNK3Or5ra2N1TiPZWppQwrIbNubZd07YA==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

GET
H2 200 0ac906913c51a9e64819c652ccd03f80 Show response
a869.mercurynews.com/templates/ 490 KB
72 KB 66ms
66ms Script
text/javascript 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/templates/0ac906913c51a9e64819c652ccd03f80

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

a197e40f8e6344ce41cdab1191cf758b41c1fb5d48b5149a8c4d76d3c8dd9c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:25:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
age: 3064438
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 73441
x-xss-protection: 1; mode=block
last-modified: Mon, 06 Nov 2023 16:25:13 GMT
server: -
etag: 0ac906913c51a9e64819c652ccd03f80
content-type: text/javascript; charset=utf-8
cache-control: public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag: noindex, nofollow
x-amz-cf-id: tERBDnZYKz3TJBc27fUpJw2OCzAndGqqARLIVCVpmG9lUo7BSs0s7g==
expires: Wed, 06 Nov 2024 16:25:13 GMT

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 192 B
1 KB 88ms
87ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A11-10%3A00&ts=1702438751725

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

72840c9222d5064d7c74b4102bc68ba61cd2bd1ae69138ff7a207f2daffc9d22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 154
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: Jln3iYxzfHsVQi99__96mSrOITC_ll6I0JUTgW6Cl0nHnwopRA9AdA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 stats Show response
a869.mercurynews.com/rest/v2/recommendations/ 57 B
896 B 81ms
80ms Script
text/javascript 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/rest/v2/recommendations/stats?storeId=0595003b-1825-43bc-89bd-9877ca21042f&action=view&itemId=10256073&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&profileId=00429c59-e969-4a8a-9909-edc20e5375b5&isEntrypage=true&hash=244c303e0555abafe39e42bb9bc39719&lastmodified=1702431291000&referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&&callback=bc_json159

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

39283e75b918e7c1b910ec667b32ff42f640cf273c0a3a6d669534e03555ffab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 77
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
content-type: text/javascript;charset=utf-8
cache-control: no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag: noindex, nofollow
x-amz-cf-id: WFol64A96h9rYqm0FLJP3PYkx1QSv2FXRRVU59EI7D0jjeiq5H-4IA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 565 B
1 KB 96ms
95ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A11-10%3A00&ts=1702438751778

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

51f38d1818ffa64eb08bcd59c939b66f53559d6aae73c250c572857632c91a4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 181
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: xZeqVo368EoSqpQXpEJYMrM-O5jp8TFXe3L5zNLj3jO5uwiW2bNM-w==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 189 B
1 KB 73ms
72ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A11-10%3A00&ts=1702438751780

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

892cf7c131038de78fa1a015eb11ba35ef694f48f1902710ec8a456ed0c31483

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 169
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: ZHTYJllybnp4wfXkdMjEdaOuRJw4GfuqNfr5NrNzf6-LqL6soQQ0XA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 377 B
1 KB 81ms
79ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A11-10%3A00&ts=1702438751782

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

43ab7aba01b9cd46dfa2fd56dca138dd4c6b4eba2fd8403e7fc0adb49c4de05a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 178
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: goaTL1nFoGz4w2rY17tOi7iNTGMedeLGb-eyhyy5mmY_C9VHj4qQyQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 5 KB
3 KB 124ms
124ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A11-10%3A00&ts=1702438751783

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

63ce9f67d927c0a39aa160a72e6041adabd1c6b0686aca19679dac5498ea65fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 2512
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: QARa3E7z4Vvu4fpvJ_o9dD6B9OZZU0Aai_hSexzjTgLeIIXfBNsRBQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 189 B
1 KB 116ms
115ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A11-10%3A00&ts=1702438751799

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

601bbb5e4aba2e84ce624ed12cf2b398668066a14f4642ce5261dcf7499b6d6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 169
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: _efLskoiO4Ku-ysxauq2l-lVFiR5rHFpGNTVxpYXGQQX027M8e1DMQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

OPTIONS
H2 200 /
geo.privacymanager.io/ Frame 0
0 472ms
280ms Preflight
application/json 3.161.213.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-79.yul62.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.mercurynews.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 ac1cb1fdb7cf3984f94f9f190169eb3a.cloudfront.net (CloudFront), 1.1 4abd8708c8464a6586e6829348c23522.cloudfront.net (CloudFront)
x-amz-apigw-id: P3MXDE0TDoEECzQ=
x-amz-cf-id: LwPtTzE664y32Vn0UOry-Q0xiykDkytvSU96FEHaxkNydoDd1EeVXg==
x-amz-cf-pop: YUL62-C2 YUL62-P1
x-amzn-requestid: 29cbe306-d705-4228-ba00-fc3b1518524b
x-cache: Miss from cloudfront

GET
H2 200 sjm-owaway-Charge_165723542.jpg
www.mercurynews.com/wp-content/uploads/2023/12/ 61 KB
61 KB 220ms
220ms Image
image/webp 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mercurynews.com/wp-content/uploads/2023/12/sjm-owaway-Charge_165723542.jpg?w=861

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

282440fb8db73e581ac898f3de990595b93ed43201588f150f31106a95b4e0d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
strict-transport-security: max-age=31536000;includeSubdomains
x-rq: mia2 80 130 443
last-modified: Wed, 13 Dec 2023 03:39:11 GMT
server: nginx
etag: "0901d1bdb9b4c36d"
vary: Accept
x-cache: MISS
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 62010

GET
H2 200 pixel;r=502063726;labels=BayAreaNewsGroup;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport...
pixel.quantserve.com/ 35 B
372 B 64ms
61ms Image
image/gif 2620:116:800b:21:4cb8:1820:80ca:50f7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=502063726;labels=BayAreaNewsGroup;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F;uht=2;fpan=1;fpa=P0-2013470657-1702438750852;pbc=;ns=0;ce=1;qjs=1;qv=6076e8c2-20231114150359;cm=;gdpr=0;us_privacy=1-N-;ref=;d=mercurynews.com;dst=0;et=1702438751823;tzo=600;ogl=type.article%2Ctitle.Russian%20man%20flies%20from%20Denmark%20to%20LAX%20with%20no%20ticket%20or%20passport%2Curl.https%3A%2F%2Fwww%252Emercurynews%252Ecom%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-wit%2Cdescription.He%20told%20officials%20he%20might%20have%20had%20a%20plane%20ticket%20to%20come%20to%20the%20United%20States%252C%2Csite_name.The%20Mercury%20News%2Cimage.https%3A%2F%2Fwww%252Emercurynews%252Ecom%2Fwp-content%2Fuploads%2F2023%2F12%2Fsjm-owaway-Charge_1657235%2Cimage%3Awidth.1024%2Cimage%3Aheight.684%2Cimage%3Aalt.%2Clocale.en_US;ses=7ffa11ff-0be7-45fb-a9ba-1ab94abdef9a;mdl=

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:4cb8:1820:80ca:50f7 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:11 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 36 B
549 B 259ms
177ms Fetch
application/json 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=945271
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ab07d55285701d49e2edb6b7ff393fc0b6d6ca593b2af020b83a0a9bd45033b

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K6CFa9wOV376wdkxlzlBefOWRvvjfKi1BZPWvtAJNWBRN%2FkKmC6nrHL3G5dp9465EtlvVDJe2yN33zFWLSllWlZrZDCXOzQJnTpmxic06KkQg%2FlgFFfCtypsIA57%2Bo7oxwe8TKxv"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 834b2db80a3b9ad2-MIA
alt-svc: h3=":443"; ma=86400
content-length: 36
expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
584 B 257ms
111ms Fetch
application/json 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-3-211-79-137.compute-1.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
an-x-request-uuid: 35bfc814-47fb-415c-b4ca-ff25b6615611
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
792 B 212ms
74ms Fetch
application/json 3.211.79.137
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.24.0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&tmax=2000&gdpr=false&us_privacy=1-N-

Requested by

Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.211.79.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
accept-ch: sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width
x-auction-status: 12, 12, 12
content-type: application/json; charset=utf-8
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
198 B 223ms
97ms Fetch 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.24.0&cb=3936221662&lsavail=1

Requested by

Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
date: Wed, 13 Dec 2023 03:39:11 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
433 B 210ms
60ms Fetch
application/json 3.209.92.95
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 3.209.92.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-92-95.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 3b56b52b26cd99197d715f002e930231e2ea390956f03191e138b203ea6dec88

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.mercurynews.com
content-type: application/json
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 84

POST
H2 200 prebid Show response
krk2.kargo.com/api/v1/ 2 B
469 B 289ms
166ms Fetch
application/json 3.220.100.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://krk2.kargo.com/api/v1/prebid
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.100.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-100-166.compute-1.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
content-encoding: gzip
x-accel-expires: 0
nbr: 510
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
content-length: 26
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 487 B
836 B 309ms
185ms Fetch
application/json 2602:803:c002:200::114
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768250&size_id=43&alt_size_ids=44&gdpr=0&us_privacy=1-N-&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&kw=Russia%2CDenmark%2CCopenhagen%2Cstowaway%2Cfederalcharges%2C&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fsponsorship_1%231&tk_flint=pbjs_lite_v8.24.0&x_source.tid=719062a2-a19c-4f6a-8c20-b5062311eda5&l_pb_bid_id=2531b5206b36a0a&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=945fd250-cfd9-4308-bbbf-63adf73591d8&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fsponsorship_1%231&m_ch_mobile=%3F0&slots=1&rand=0.994039177309253
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::114 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f47702b0bc0868e72f9c8a2c60b940dbba2ce5c0b02eee4b60d425ae28434e35

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 487
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 491 B
1018 B 253ms
130ms Fetch
application/json 2602:803:c002:200::114
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768258&size_id=2&alt_size_ids=55%2C57&gdpr=0&us_privacy=1-N-&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&kw=Russia%2CDenmark%2CCopenhagen%2Cstowaway%2Cfederalcharges%2C&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Ftop_leaderboard%231&tk_flint=pbjs_lite_v8.24.0&x_source.tid=719062a2-a19c-4f6a-8c20-b5062311eda5&l_pb_bid_id=26a59596dfd1801&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=3bafc7a9-87ca-4863-88e6-1cd41bb5c054&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Ftop_leaderboard%231&m_ch_mobile=%3F0&slots=1&rand=0.20998355824119197
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::114 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 0eaaa2f621ae9c6469f221c5770da81a508e0c693fde788eff60d2aba4c435cd

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 491
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 491 B
840 B 263ms
140ms Fetch
application/json 2602:803:c002:200::114
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768236&size_id=15&alt_size_ids=9%2C10%2C54&gdpr=0&us_privacy=1-N-&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&kw=Russia%2CDenmark%2CCopenhagen%2Cstowaway%2Cfederalcharges%2C&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fcube1_rrail_atf%231&tk_flint=pbjs_lite_v8.24.0&x_source.tid=719062a2-a19c-4f6a-8c20-b5062311eda5&l_pb_bid_id=272c64fd708803f&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=3af95a2f-c7e1-49cb-bfe1-a6127702b9eb&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fcube1_rrail_atf%231&m_ch_mobile=%3F0&slots=1&rand=0.1757171038835592
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::114 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 742657685c55eae7d1265fd34b47da275a5a3652386c8fedb70dd1207561f247

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 491
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
119 B 261ms
128ms Fetch 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
date: Wed, 13 Dec 2023 03:39:11 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H/1.1 200
OK medianewsgroup Show response
direct.adsrvr.org/bid/bidder/ 0
403 B 199ms
70ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/medianewsgroup
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:11 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

GET
H2 204 prebid Show response
ads.yieldmo.com/exchange/ 0
228 B 188ms
58ms Fetch 52.0.227.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=8.24.0&p=%5B%7B%22placement_id%22%3A%22htlad-1-gpt%22%2C%22callback_id%22%3A%2237ad0b7c16c85fb%22%2C%22sizes%22%3A%5B%5B300%2C50%5D%2C%5B320%2C50%5D%5D%2C%22ym_placement_id%22%3A%223263962355775513258%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fsponsorship_1%231%22%2C%22tid%22%3A%22945fd250-cfd9-4308-bbbf-63adf73591d8%22%2C%22auctionId%22%3A%22719062a2-a19c-4f6a-8c20-b5062311eda5%22%7D%2C%7B%22placement_id%22%3A%22htlad-3-gpt%22%2C%22callback_id%22%3A%2238344a365d163e8%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%2C%5B970%2C250%5D%5D%2C%22ym_placement_id%22%3A%223263962357730058934%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Ftop_leaderboard%231%22%2C%22tid%22%3A%223bafc7a9-87ca-4863-88e6-1cd41bb5c054%22%2C%22auctionId%22%3A%22719062a2-a19c-4f6a-8c20-b5062311eda5%22%7D%2C%7B%22placement_id%22%3A%22htlad-6-gpt%22%2C%22callback_id%22%3A%22390ad4c9272b9f8%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B300%2C1050%5D%2C%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%223263962352562676374%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fcube1_rrail_atf%231%22%2C%22tid%22%3A%223af95a2f-c7e1-49cb-bfe1-a6127702b9eb%22%2C%22auctionId%22%3A%22719062a2-a19c-4f6a-8c20-b5062311eda5%22%7D%5D&page_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bust=1702438751928&dnt=false&description=He%20told%20officials%20he%20might%20have%20had%20a%20plane%20ticket%20to%20come%20to%20the%20United%20States%2C%20but%20he%20was%20not%20sure.%20He%20also%20said%20he%20didn%27t%20remember%20how%20he%20got%20through%20security%20in%20Copenhagen%20and%20wouldn%27t%20explain%20what%20he%20was%20doing%20in%20the%20Scandinavian%20city%2C%20according%20to%20the%20complaint.&tmax=2000&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1-N-&pr=&scrd=1&title=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&w=1600&h=1200
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.227.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-227-33.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
access-control-allow-credentials: true
x-robots-tag: none,NOINDEX,NOFOLLOW
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 200 3391 Show response
config.aps.amazon-adsystem.com/configs/ 714 B
990 B 263ms
75ms Script
application/javascript 54.192.51.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/3391
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-124.yul62.r.cloudfront.net
Software: CloudFront /
Resource Hash: 507c28d818e28e9acf92128ceccf5dc29c3018399a613a1bc6722d2d819bc786

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:36:35 GMT
via: 1.1 47373525d370c4b58e8b2be88c66f646.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: YUL62-C2
age: 157
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 714
x-amz-cf-id: 4dkWEuYqZNas8tD0kYb-LnXgiKQWSiA89aMiDh-FI37OUrO8E58ibg==

GET config
c.amazon-adsystem.com/cdn/prod/ 0
0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 279 B
724 B 447ms
236ms XHR
text/javascript 3.161.212.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3391&u=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&pid=NfvGmwOpuHjtl&cb=0&ws=1600x1200&v=23.1211.1645&t=2000&slots=%5B%7B%22sd%22%3A%22htlad-1-gpt%22%2C%22s%22%3A%5B%22300x50%22%2C%22320x50%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fsponsorship_1%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-3-gpt%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Ftop_leaderboard%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-6-gpt%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22300x1050%22%2C%22160x600%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fcube1_rrail_atf%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&gpp=DBACOe~CP2uYgAP2uYgAEXeBAENDeEwAP_gAEPgACiQGgwFQAFAANAAyABwAEAAJAAaAA9ACgAFsANAAhIBHAEeAKQAVoBAACDgKiAXmAxkBoIF5wCgAMgAcABAADQANAAhABHAEAAIOAvMAAAA~BP2uYgAP2uYgAEXeBAENDeCgAf_AAIfAAAaDAVAAUAA0ADIAHAAQAAkABoAD0AKAAWwA0ACEgEcAR4ApABWgEAAIOAqIBeYDGQGggXnAKAAyABwAEAANAA0ACEAEcAQAAg4C8w~1-N-&gpp_sid=%5B6%5D&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.212.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-212-32.yul62.r.cloudfront.net

Software

Server /

Resource Hash

005a749f3521228b81cafd7df2d1b3e729dedb474e1240513423883b4edcaf61

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 4abd8708c8464a6586e6829348c23522.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: YUL62-P1
x-amz-rid: CH0MRC0EKTC0RP15JZ6R
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.mercurynews.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 279
x-amz-cf-id: 7EbzM9TMqSAdrgnYRvtaIqF1gvxdXwqiuXIOxg3twFzdxSW9NNfAgQ==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 229ms
155ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: b17fab9ee6fa22efc40f040750df4d5c
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 196ms
65ms Script
text/javascript 108.138.128.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-28.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 21:54:37 GMT
content-encoding: gzip
via: 1.1 e23983892b1c8fb4d47f943c0ee29028.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
age: 20676
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: toDAbT_7e6jacGVlVq8dMbMHKhFeJS0oc3TSs_goi8uNVVlYdNKSww==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 104ms
32ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 17:15:46 GMT
content-encoding: gzip
age: 1160606
x-guploader-uploadid: ABPtcPqT7lSh7eTnonD6ERs82Kx3RCe38S-Yyl7o7ZB-qP71G56wLiCK2MFRriTKagBW0GnokfGv3cf1hYHxr1mFSmKTtSWixAms
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 28 Nov 2024 17:15:46 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 43 KB
13 KB 218ms
107ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

2f1ad4ec7176f493b16e0d186f222e3484248cbb48f82289c736a0877f2d5894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 05 Dec 2023 05:12:22 GMT
server: nginx
etag: W/"656eb136-aa2f"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 14 Dec 2023 03:39:12 GMT

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 11 KB
5 KB 114ms
40ms Script
application/javascript 104.18.35.167
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.35.167 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6cfe89b284e6a2100a86b8d6b0e52b76b85cc62622a40d63e929f328d883a6a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:13 GMT
server: cloudflare
age: 239680
etag: W/"65401291-2b7d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 834b2db87cda6c88-MIA
expires: Sat, 16 Dec 2023 03:39:12 GMT

GET
H2 200 UnitRecoReelWidgetDesktop.min.js Show response
vidstat.taboola.com/lite-unit/4.6.4/ 121 KB
34 KB 33ms
32ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidstat.taboola.com/lite-unit/4.6.4/UnitRecoReelWidgetDesktop.min.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6843e17303b4e4faa4ac745b44439198994904ae453d99e84922e4185f281b1e

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 b3fa6483b226ef7cc87d8bab653f621c.cloudfront.net (CloudFront), 1.1 varnish
content-encoding: gzip
x-amz-cf-pop: MIA3-C3
age: 265723
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront, HIT
content-length: 34502
x-served-by: cache-mia-kmia1760049-MIA
last-modified: Sat, 09 Dec 2023 10:01:25 GMT
server: AmazonS3
x-timer: S1702438752.085404,VS0,VE0
etag: "adc0ee4f168ef41bc382bd6cc648c21c"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
access-control-allow-headers: *
x-amz-cf-id: EpCrwvVNI2IdnkPYDj_oJEArfEoW5NZzS586QKe3vnEweZowlivyaQ==
x-cache-hits: 2564

GET
H2 200 UnitFeedManagerDesktop.min.js Show response
vidstat.taboola.com/lite-unit/4.6.4/ 121 KB
34 KB 35ms
35ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidstat.taboola.com/lite-unit/4.6.4/UnitFeedManagerDesktop.min.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 756389980ba122ba0dfda65364542c4aa447ffcd31ac6a801cb5e6fadd53fab8

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 177fd0f8c3e2c78883d72714aa07183a.cloudfront.net (CloudFront), 1.1 varnish
content-encoding: gzip
x-amz-cf-pop: MIA3-C3
age: 314506
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront, HIT
content-length: 34291
x-served-by: cache-mia-kmia1760049-MIA
last-modified: Sat, 09 Dec 2023 10:01:25 GMT
server: AmazonS3
x-timer: S1702438752.095641,VS0,VE0
etag: "8dc95909e5ade1acce6211e186499545"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
access-control-allow-headers: *
x-amz-cf-id: S-Wn8eeQoTpylE_kch4RTuRNLPpvo9STPMLP4yHpMKal8VqRSpVq1w==
x-cache-hits: 20514

GET
H2 204 abtests
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
505 B 280ms
68ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22block_clicks_init%22%2C%22type%22%3A%22block-clicks-manager%22%2C%22eventTime%22%3A1702438752043%7D&tim=17%3A39%3A12.044&id=7252&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 supply-feature
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 281ms
69ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/supply-feature?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22event_type%22%3A%22EXPLORE_MORE%22%2C%22event_state%22%3A%22ADOPTED%22%2C%22event_value%22%3A%22%22%2C%22event_msg%22%3A%22%22%2C%22event_key%22%3A%22%22%7D&tim=17%3A39%3A12.134&id=451&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 200 f89e1763-220d-4e09-ba69-9e040548fb7a.svg
cdn.taboola.com/static/f8/ 4 KB
2 KB 32ms
32ms Image
image/svg+xml 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.taboola.com/static/f8/f89e1763-220d-4e09-ba69-9e040548fb7a.svg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 39b076e4bb4fab9b8a142499cf6155f8c128464974691a04de7e764f71b72618

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: cMrDKn.emLmm9kiiOOF64ulDT4DRy6LK
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:12 GMT
x-amz-request-id: XHJ7EC52G5FQ4B94
age: 23
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 1758
x-amz-id-2: GtBmi0VQNkJ83eo9f/jIlspt6kQ3Gwwa/vuMTnLSRQwAUAW+DYJtvgt0euB87PexW8Pb2l/h+Ek=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Wed, 07 Feb 2018 11:15:52 GMT
server: AmazonS3
x-timer: S1702438752.233899,VS0,VE0
etag: "b8b410e4b18d45aa2f3d9bc09cd335fb"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
abp: 27
cache-control: private,max-age=31536000
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 13

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 6 KB
4 KB 83ms
83ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A12-10%3A00&ts=1702438752288

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-232-121-20.compute-1.amazonaws.com

Software

- /

Resource Hash

b1ad7a668596049d3bb0e25b0b090cfeec3e4f45ec06bafce6a07608b88af306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 2582
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: UgCshGkajN5Rtp3vrhfGlSbwkY3rb-r9-bcteGB52M7Y0OkvIESb5w==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK a-04i4 Show response
i.liadm.com/s/c/ Frame 3D08 1 KB
1 KB 264ms
75ms Document
text/html 34.232.121.20
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://i.liadm.com/s/c/a-04i4?duid=f107d3ac6b63--01hhgm3jp4b3510ykvt3etkph9&euns=0&s=&us_privacy=1-N-&gpp_s=DBACOe~CP2uYgAP2uYgAEXeBAENDeEwAP_gAEPgACiQGgwFQAFAANAAyABwAEAAJAAaAA9ACgAFsANAAhIBHAEeAKQAVoBAACDgKiAXmAxkBoIF5wCgAMgAcABAADQANAAhABHAEAAIOAvMAAAA~BP2uYgAP2uYgAEXeBAENDeCgAf_AAIfAAAaDAVAAUAA0ADIAHAAQAAkABoAD0AKAAWwA0ACEgEcAR4ApABWgEAAIOAqIBeYDGQGggXnAKAAyABwAEAANAA0ACEAEcAQAAg4C8w~1-N-&gpp_as=6&version=v2.11.2&

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.232.121.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

4d7bc2ed5b410343707a97df304a5ac527d9401b66c2231be61aeeb87ef533fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-cache, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 691
Content-Type: text/html; charset=UTF-8
Date: Wed, 13 Dec 2023 03:39:12 GMT
Request-Time: 17
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H/1.1 200
OK baker
sli.mercurynews.com/ 19 B
368 B 323ms
98ms Image
image/gif 23.1.105.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sli.mercurynews.com/baker?dtstmp=1702438752339
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.105.202 Atlanta, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-1-105-202.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Expires: Wed, 13 Dec 2023 03:39:12 GMT
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 19
Content-Type: image/gif

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1 KB 74ms
73ms Script
text/javascript 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 02:53:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2770
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 697
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 13 Dec 2023 03:53:02 GMT

GET
H2 204 abtests
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 124ms
70ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22recommendation-reel%22%2C%22type%22%3A%22available%22%2C%22eventTime%22%3A1702438752356%7D&tim=17%3A39%3A12.356&id=4434&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 abtests
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 79ms
71ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22recommendation-reel%22%2C%22type%22%3A%22available%22%2C%22eventTime%22%3A1702438752395%7D&tim=17%3A39%3A12.396&id=2478&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 200 SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/ 15 KB
16 KB 71ms
68ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 36c10082ae7a080c08b10540d245094b91756ce6e467e2212e0beb8be0ef9392

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 30
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
age: 1820722
edge-cache-tag: 317020479385025417607082963236979735315,408827614211426674112500014738954083413,29ecf9b93bbf306179626feeda1fab70
cache-tag: 317020479385025417607082963236979735315,408827614211426674112500014738954083413,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, MISS
x-envoy-upstream-service-time: 512
req-referer: https://www.mercurynews.com/
content-length: 15390
x-request-id: b63e714b623c4c5a51741f9b96b135e7
x-backend-name: US_nlb103
x-served-by: cache-iad-kjyo7100074-IAD, cache-iad-kiad7000073-IAD, cache-ewr18153-EWR, cache-iad-kjyo7100147-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 22 Nov 2023 01:36:00 GMT
server: nginx
surrogate-reporting: width=1160,height=645,bytes=34390,owidth=400,oheight=232,obytes=12810
x-timer: S1702438752.438508,VS0,VE30
etag: "bb2ed77bc0ec6941f1bbf785925080cc"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 723, 0

GET
H2 200 Ave14.png%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/ 27 KB
28 KB 40ms
37ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/Ave14.png%3Fw%3D1024%26h%3D614
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 953fd5feea050a40d2b91062547375b47edc1cd02a88e9215d14a5ad9baf8e22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/Ave14.png%3Fw%3D1024%26h%3D614
age: 1243902
edge-cache-tag: 627189581876985036857010054268331790179,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 627189581876985036857010054268331790179,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 993
req-referer: https://www.mercurynews.com/
content-length: 28136
x-request-id: f809ae0a6c1bac8c5eece49427349868
x-backend-name: CH_nlb801
x-served-by: cache-iad-kiad7000140-IAD, cache-iad-kjyo7100130-IAD, cache-lga21957-LGA, cache-iad-kiad7000037-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 28 Nov 2023 18:07:30 GMT
server: nginx
surrogate-reporting: width=1023,height=568,bytes=37329,owidth=1023,oheight=614,obytes=556915
x-timer: S1702438752.438557,VS0,VE1
etag: "b7089a6bdbcfd4cb0e24b1410eafdef2"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 0, 21, 1

GET
H2 200 cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/ 32 KB
33 KB 42ms
40ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 65d9d4089e02682fe8f3464f61e77d16dd93c2f99963f9f028ff7b21acb17c2e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
age: 617889
edge-cache-tag: 424083472584467310278589997397055134424,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 424083472584467310278589997397055134424,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 504
req-referer: https://www.mercurynews.com/
content-length: 32372
x-request-id: 8ceb274aee5d7e5c4ef7c5ffeefdd52e
x-backend-name: US_nlb102
x-served-by: cache-iad-kcgs7200088-IAD, cache-iad-kiad7000170-IAD, cache-lga21977-LGA, cache-iad-kiad7000159-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 05 Dec 2023 23:56:43 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=46936,owidth=1024,oheight=699,obytes=69258
x-timer: S1702438752.438650,VS0,VE2
etag: "e622c673938fc8ce2f7fd3dd85f3282e"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 0, 17, 1

GET
H2 200 cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/ 114 KB
115 KB 46ms
44ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9f9e6145ea2158d9972fd5e287ed78ee821843a19c4d61fcc02eb8bf39eb87ec

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 3
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
age: 465333
edge-cache-tag: 312153743501965851414173133759212135963,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 312153743501965851414173133759212135963,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 450
req-referer: https://www.mercurynews.com/
content-length: 116560
x-request-id: 545fdc14a502fcb3298da7a68a2753c2
x-backend-name: CH_nlb803
x-served-by: cache-iad-kjyo7100154-IAD, cache-iad-kiad7000131-IAD, cache-lga21966-LGA, cache-iad-kcgs7200076-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 07 Dec 2023 18:20:06 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=98380,owidth=1024,oheight=682,obytes=153879
x-timer: S1702438752.438479,VS0,VE3
etag: "425761048296191d1ac649e0bb408320"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 2, 7, 1

GET
BLOB 200
OK bf8599b4-7fd3-4d44-bbba-60843952ea0c
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/bf8599b4-7fd3-4d44-bbba-60843952ea0c
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
BLOB 200
OK 081d29f8-fcf4-4282-9444-8c65626e950a
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/081d29f8-fcf4-4282-9444-8c65626e950a
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 d126473e394e98865383b10e537edd8f.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 8 KB
9 KB 36ms
35ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d126473e394e98865383b10e537edd8f.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 26c123d404f14984be617eb47d3bd57e3d750f1a90cbf839da43e9f3de74581e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d126473e394e98865383b10e537edd8f.png
age: 3067627
edge-cache-tag: 539210902492927692742835379311962421630,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 539210902492927692742835379311962421630,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache: MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 227
expiration: expiry-date="Tue, 03 Oct 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://games.espn.com/
content-length: 8070
x-backend-name: CH_nlb803
x-served-by: cache-iad-kcgs7200112-IAD, cache-iad-kjyo7100101-IAD, cache-iad-kjyo7100055-IAD, cache-mia-kmia1760053-MIA
last-modified: Sat, 02 Sep 2023 08:17:10 GMT
server: nginx
surrogate-reporting: width=380,height=212,owidth=1525,oheight=765,obytes=1134379
x-timer: S1702438752.438482,VS0,VE0
etag: "9cbd1ecdcdb303f036b59847943b66cb"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 3, 235

GET
H2 200 bc82403594b00f595fbe5d00b461baef.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 6 KB
7 KB 33ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bc82403594b00f595fbe5d00b461baef.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 8e44547d9edf28f58cf6d3bd7e7b409cceee79d9ea19115b7da7060673ad8f35

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bc82403594b00f595fbe5d00b461baef.png
age: 3582652
edge-cache-tag: 542168430524927073506661066427688148256,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 542168430524927073506661066427688148256,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 99
req-referer: https://www.sciencealert.com/
content-length: 6648
x-request-id: 581ccbccd8026c3174b454d77959d74a
x-backend-name: CH_nlb803
x-served-by: cache-iad-kiad7000073-IAD, cache-iad-kiad7000098-IAD, cache-chi-kigq8000021-CHI, cache-iad-kiad7000031-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 06 Oct 2023 08:59:39 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=9962,owidth=1000,oheight=600,obytes=467606
x-timer: S1702438752.475573,VS0,VE1
etag: "c242a2336342766275f2f9fdaa8ad696"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1, 2063, 1

GET
H2 200 e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/ 13 KB
14 KB 35ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9ec7fa777b35448307d9468f83284d9005ec1e6fbdb1bf19077f4b2906adad29

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
age: 1784318
edge-cache-tag: 621187487363277256754215053997781261661,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 621187487363277256754215053997781261661,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 530
req-referer: https://www.macombdaily.com/
content-length: 13272
x-request-id: 7d5fcd15047c1f90eeefbff3d2d143eb
x-backend-name: US_nlb106
x-served-by: cache-iad-kjyo7100164-IAD, cache-iad-kiad7000118-IAD, cache-lga21970-LGA, cache-iad-kjyo7100101-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 22 Nov 2023 04:24:08 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=23342,owidth=1344,oheight=768,obytes=122375
x-timer: S1702438752.478046,VS0,VE1
etag: "9c670959dd1efa31f6b9663d9b840734"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 27, 1

GET
H2 200 038fc0d258a444f90ebed86977570757.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 43 KB
43 KB 35ms
35ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/038fc0d258a444f90ebed86977570757.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: c39536d88dba4f38bbeaff1274aad0de33d958e70540989c90d6e10d3221841b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/038fc0d258a444f90ebed86977570757.jpg
age: 2496659
edge-cache-tag: 481046977673515010584110319516902791763,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 481046977673515010584110319516902791763,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: MISS, HIT, HIT, HIT
x-envoy-upstream-service-time: 213
req-referer: https://d-2093356943695717428.ampproject.net/
content-length: 43542
x-request-id: c6c23143a26c8fb184a0c21d45673fd5
x-backend-name: CH_nlb804
x-served-by: cache-iad-kiad7000103-IAD, cache-iad-kiad7000151-IAD, cache-iad-kjyo7100108-IAD, cache-mia-kmia1760053-MIA
last-modified: Mon, 11 Sep 2023 14:22:25 GMT
server: nginx
surrogate-reporting: width=1000,height=555,bytes=111166,owidth=1000,oheight=600,obytes=519157
x-timer: S1702438752.480447,VS0,VE2
etag: "d0d1a9996076a3a8501c95152aad05da"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 18, 1

GET
H2 200 f197074efb91e4147970d9c52f266e20.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 40 KB
41 KB 34ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f197074efb91e4147970d9c52f266e20.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 8034fd3a3c9a0ba6eab03b5206b825f7882e15e4da90608b3cbdfe4045a33c1e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f197074efb91e4147970d9c52f266e20.png
age: 1951779
edge-cache-tag: 581483605587258704110332802552235956860,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 581483605587258704110332802552235956860,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 261
req-referer: https://wgxa.tv/news/state-news/philadelphia-man-and-former-uga-football-player-convicted-in-fatal-georgia-gas-station-robbery-case
content-length: 40960
x-request-id: 29a96bcc3af16847cdfc2d9874969993
x-backend-name: LA_nlb201
x-served-by: cache-iad-kiad7000141-IAD, cache-iad-kjyo7100084-IAD, cache-lax-kwhp1940096-LAX, cache-iad-kjyo7100038-IAD, cache-mia-kmia1760053-MIA
last-modified: Mon, 20 Nov 2023 12:18:38 GMT
server: nginx
surrogate-reporting: width=1000,height=555,bytes=86696,owidth=1000,oheight=563,obytes=1080157
x-timer: S1702438752.493678,VS0,VE0
etag: "732074585fe2153353dd87327d5ef698"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 1, 15, 2

GET
H2 200 c0d96ff9819d0023e0226e19bb313667.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 27 KB
28 KB 36ms
34ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c0d96ff9819d0023e0226e19bb313667.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 3b48a1b3adfe6108516b13e88fa39a9fc3c769776b8339e124946a9b7312d0ac

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 3
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c0d96ff9819d0023e0226e19bb313667.jpg
age: 3794393
edge-cache-tag: 585911644301119625494580134240590334988,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 585911644301119625494580134240590334988,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 610
req-referer: https://tamil.mykhel.com/
content-length: 27512
x-request-id: 3259aa6ce0992074b24562f3f9bfac43
x-backend-name: LA_nlb202
x-served-by: cache-iad-kjyo7100128-IAD, cache-iad-kcgs7200105-IAD, cache-sna10730-LGB, cache-iad-kjyo7100033-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 11 Oct 2023 22:46:57 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=34533,owidth=2048,oheight=1366,obytes=775469
x-timer: S1702438753.505181,VS0,VE3
etag: "0e752d3e42baf6282051099bd7ec39c3"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 23, 1

GET
H2 200 daf466f934189032591a689c36ad0653.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 10 KB
10 KB 34ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/daf466f934189032591a689c36ad0653.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 2419070bc341b47696c99a1bb32cd870a023bd4f2aad566477578c1b98fae463

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/daf466f934189032591a689c36ad0653.jpg
age: 1077671
edge-cache-tag: 593790470313336131287894604481256473594,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 593790470313336131287894604481256473594,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 241
req-referer: https://games.espn.com/
content-length: 9818
x-request-id: a3394d53de11dc32ff9bdc5c1a994028
x-backend-name: LA_nlb202
x-served-by: cache-iad-kjyo7100022-IAD, cache-iad-kcgs7200059-IAD, cache-lax-kwhp1940028-LAX, cache-iad-kjyo7100136-IAD, cache-mia-kmia1760053-MIA
last-modified: Sun, 12 Nov 2023 21:32:29 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=16496,owidth=1000,oheight=600,obytes=719554
x-timer: S1702438753.505389,VS0,VE1
etag: "bdfe033acf979a2758d9587f9bcbfa07"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 0, 110, 1

GET
H2 200 d28b2e2ba902d0cce80a8c74ec89e12c.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 22 KB
23 KB 34ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d28b2e2ba902d0cce80a8c74ec89e12c.jpeg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: fc21b1036df706a8bbb0cbfb27ee7a67878ed073490c58bab4a5892f3febc64d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d28b2e2ba902d0cce80a8c74ec89e12c.jpeg
age: 2398528
edge-cache-tag: 601245163646100537438941613453255915946,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 601245163646100537438941613453255915946,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 470
req-referer: https://www.tag24.de/dresden/lokales/darum-war-gruenen-vorsitzende-ricarda-lang-in-dresden-2932575
content-length: 22532
x-request-id: e1fbd4233a9abcf3a625ad820e9d2207
x-backend-name: LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb204
x-served-by: cache-iad-kiad7000105-IAD, cache-iad-kiad7000135-IAD, cache-sna10734-LGB, cache-iad-kcgs7200046-IAD, cache-mia-kmia1760053-MIA
last-modified: Sun, 20 Aug 2023 21:53:04 GMT
server: nginx
x-timer: S1702438753.509132,VS0,VE1
etag: "ee8c4d65349c274d307412054d909568"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 2906, 1

GET
H2 200 b50b0ed333453a723506b5038e163e00.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 32 KB
33 KB 34ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b50b0ed333453a723506b5038e163e00.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 73b450b4321873ef3c8944c81dec8dfaea13e36a7659b60f0d13f79dfed0684b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b50b0ed333453a723506b5038e163e00.png
age: 1181921
edge-cache-tag: 332756915896506759957712898242194238422,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
cache-tag: 332756915896506759957712898242194238422,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 107
req-referer: https://www.tips-and-tricks.co/
content-length: 32872
x-request-id: 20c7a5562d491d9afd297ed89c4e7def
x-backend-name: CH_nlb801
x-served-by: cache-iad-kcgs7200138-IAD, cache-iad-kjyo7100060-IAD, cache-lga21960-LGA, cache-iad-kiad7000068-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 29 Nov 2023 10:17:59 GMT
server: nginx
surrogate-reporting: width=580,height=323,bytes=49494,owidth=994,oheight=868,obytes=1662607
x-timer: S1702438753.514608,VS0,VE1
etag: "7da7c65d03ca014dfa84608b81c571a9"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 0, 658, 1

GET
H2 200 b4bfa6fd170b7fa85a8f2c67085b9f0c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 17 KB
18 KB 34ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b4bfa6fd170b7fa85a8f2c67085b9f0c.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: dbcaee63225eb41f4ee33dfeab08533d89d238ecdf3827987fe99be08b83f44a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b4bfa6fd170b7fa85a8f2c67085b9f0c.jpg
age: 2972461
edge-cache-tag: 627692022150049761669145501006249285160,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 627692022150049761669145501006249285160,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 143
expiration: expiry-date="Mon, 06 Nov 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://weather.com/
content-length: 17512
x-backend-name: US_nlb104
x-served-by: cache-iad-kiad7000175-IAD, cache-iad-kiad7000175-IAD, cache-lga21940-LGA, cache-iad-kcgs7200048-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 06 Oct 2023 12:50:11 GMT
server: nginx
surrogate-reporting: width=1200,height=666,bytes=60317,owidth=1200,oheight=675,obytes=152847
x-timer: S1702438753.520399,VS0,VE1
etag: "48351d71ea6d35587b696567298fa441"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3, 1, 2, 1

GET
H2 200 8665cc72ca7b72e8676851cc7e048c0b.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 8 KB
9 KB 33ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/8665cc72ca7b72e8676851cc7e048c0b.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 7e0b70ba3459306fe1de971c4325b63b0a4f46ad8ad37cedd157e314d9878486

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/8665cc72ca7b72e8676851cc7e048c0b.png
age: 3475170
edge-cache-tag: 361678236527001311724946627086440959513,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 361678236527001311724946627086440959513,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 192
req-referer: https://www.businessinsider.com/
content-length: 8394
x-request-id: 3a04497f1f183536972b6f29f040fc6f
x-backend-name: LA_nlb202
x-served-by: cache-iad-kcgs7200061-IAD, cache-iad-kiad7000096-IAD, cache-lax-kwhp1940086-LAX, cache-iad-kcgs7200081-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 02 Nov 2023 18:02:17 GMT
server: nginx
surrogate-reporting: width=932,height=517,bytes=25222,owidth=932,oheight=524,obytes=452446
x-timer: S1702438753.530023,VS0,VE1
etag: "b3f16fc66d530107d9f15377cf5b7d94"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 4, 1, 964, 1

GET
H2 200 a610f4421288d6ca962444ac4054c395.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 18 KB
19 KB 34ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a610f4421288d6ca962444ac4054c395.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ed2c4e3ffdcdaf77e515923ea1c04487199e06c7ca9bf2dc4501da242816fed4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a610f4421288d6ca962444ac4054c395.jpg
age: 1168909
edge-cache-tag: 459176240468581745913164843815447083800,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 459176240468581745913164843815447083800,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 211
expiration: expiry-date="Tue, 14 Nov 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://www.denverpost.com/
content-length: 18212
x-backend-name: US_nlb103
x-served-by: cache-iad-kjyo7100124-IAD, cache-iad-kiad7000160-IAD, cache-iad-kiad7000088-IAD, cache-mia-kmia1760053-MIA
last-modified: Sat, 14 Oct 2023 18:41:29 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=26317,owidth=1000,oheight=600,obytes=139974
x-timer: S1702438753.541790,VS0,VE1
etag: "2d17d064c064f52b5fa5793b69cc5d02"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 20893, 1

GET
H2 200 1696506373_7bbf6f64236a19161a1caed1743c4fc0bd915883.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//www.misterstory.com/afbeeldingen/1200x630/ 20 KB
20 KB 36ms
35ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//www.misterstory.com/afbeeldingen/1200x630/1696506373_7bbf6f64236a19161a1caed1743c4fc0bd915883.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 019b6cbc4194fd6066b4ce302bcf0a6293b9e1e9eac2396dd71fdd9c3366edbc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//www.misterstory.com/afbeeldingen/1200x630/1696506373_7bbf6f64236a19161a1caed1743c4fc0bd915883.png
age: 2465083
edge-cache-tag: 419344205928490594007090446534674992200,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 419344205928490594007090446534674992200,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 216
expiration: expiry-date="Sat, 18 Nov 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://apnews.com/
content-length: 20190
x-backend-name: CH_nlb801
x-served-by: cache-iad-kcgs7200146-IAD, cache-iad-kjyo7100097-IAD, cache-chi-kigq8000123-CHI, cache-iad-kiad7000139-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 18 Oct 2023 17:17:52 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=31852,owidth=1200,oheight=630,obytes=1082015
x-timer: S1702438753.545473,VS0,VE1
etag: "3c94fc45f0a36e3cf4432f9bffda4727"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 210, 1

GET
H2 200 SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/ 19 KB
20 KB 35ms
35ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f4ec36824e2cfa2f172a3b969aa5482e73876d5f9698cc8e8920fc524ac26800

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
age: 1821122
edge-cache-tag: 317020479385025417607082963236979735315,588110943443000055148103821789501219624,29ecf9b93bbf306179626feeda1fab70
cache-tag: 317020479385025417607082963236979735315,588110943443000055148103821789501219624,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 793
req-referer: https://www.mercurynews.com/
content-length: 19592
x-request-id: 97f2a2dfb0448398b920d7acb4cf053e
x-backend-name: CH_nlb802
x-served-by: cache-iad-kcgs7200143-IAD, cache-iad-kiad7000142-IAD, cache-lga21937-LGA, cache-iad-kiad7000118-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 22 Nov 2023 01:36:00 GMT
server: nginx
surrogate-reporting: width=1500,height=750,bytes=44728,owidth=400,oheight=232,obytes=12810
x-timer: S1702438753.545488,VS0,VE2
etag: "226eb2bab1419e1206e1a5972b055ef8"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 226, 1

GET
BLOB 200
OK f2aef71e-f149-4a3b-9ecc-e4911e0355f9
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/f2aef71e-f149-4a3b-9ecc-e4911e0355f9
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 Ave14.png%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/ 35 KB
36 KB 36ms
34ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/Ave14.png%3Fw%3D1024%26h%3D614
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: bd7b908e8b830319aaa966a643d9cd8a9ecfcc16955ac11ede466237ffcb89eb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/Ave14.png%3Fw%3D1024%26h%3D614
age: 1242519
edge-cache-tag: 627189581876985036857010054268331790179,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag: 627189581876985036857010054268331790179,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 1042
req-referer: https://www.mercurynews.com/
content-length: 35698
x-request-id: 54d5d430f9d237accc7ae50b3c86ce70
x-backend-name: CH_nlb804
x-served-by: cache-iad-kiad7000142-IAD, cache-iad-kcgs7200031-IAD, cache-lga21971-LGA, cache-iad-kjyo7100173-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 28 Nov 2023 18:07:29 GMT
server: nginx
surrogate-reporting: width=1023,height=511,bytes=35285,owidth=1023,oheight=614,obytes=556915
x-timer: S1702438753.555194,VS0,VE2
etag: "7ae4e360d9f97429cb9e06fb614c5e65"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 16, 1

GET
H2 200 cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/ 39 KB
40 KB 37ms
37ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f4b99363ef9645733f2edbf0de488bdbd9833884e8b92bd368bc92aed9e8bb92

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 3
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
age: 618150
edge-cache-tag: 424083472584467310278589997397055134424,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag: 424083472584467310278589997397055134424,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time: 607
req-referer: https://www.mercurynews.com/
content-length: 39652
x-request-id: b148cb7b734e6d72c42c3ab1ba5111b9
x-backend-name: CH_nlb801
x-served-by: cache-iad-kcgs7200134-IAD, cache-iad-kcgs7200065-IAD, cache-lga21953-LGA, cache-iad-kjyo7100054-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 05 Dec 2023 23:56:43 GMT
server: nginx
surrogate-reporting: width=1024,height=512,bytes=39121,owidth=1024,oheight=699,obytes=69258
x-timer: S1702438753.555246,VS0,VE3
etag: "b42c014435f5667023d2a5885e6e9e0a"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 1, 7, 1

GET
H2 200 cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/ 124 KB
125 KB 34ms
34ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b6034abcaf2e9d117fa7536d1bf38ab061e262af605e404e8936fba08251bb69

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 3
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
age: 465546
edge-cache-tag: 312153743501965851414173133759212135963,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag: 312153743501965851414173133759212135963,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 1462
req-referer: https://www.mercurynews.com/
content-length: 126802
x-request-id: 499864f332a840fd839292bc6b6c9063
x-backend-name: CH_nlb804
x-served-by: cache-iad-kiad7000124-IAD, cache-iad-kjyo7100053-IAD, cache-lga21930-LGA, cache-iad-kjyo7100040-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 07 Dec 2023 18:20:06 GMT
server: nginx
surrogate-reporting: width=1024,height=512,bytes=81779,owidth=1024,oheight=682,obytes=153879
x-timer: S1702438753.563805,VS0,VE3
etag: "cb16493df22b50cf3a96a96d6d07fb48"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 342, 1

GET
H2 200 EBT-L-OAKSHOOT-1210-1.jpeg%3Fw%3D1024%26h%3D733
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/12/ 111 KB
112 KB 35ms
34ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/12/EBT-L-OAKSHOOT-1210-1.jpeg%3Fw%3D1024%26h%3D733
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 688065685e245f9a2d327022796105c4d85687da5092219b8dc2fc2ca379ed62

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/12/EBT-L-OAKSHOOT-1210-1.jpeg%3Fw%3D1024%26h%3D733
age: 1568458
edge-cache-tag: 601081217774461401803514183276394464289,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag: 601081217774461401803514183276394464289,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 815
req-referer: https://www.mercurynews.com/
content-length: 113676
x-request-id: ffcb00d2e4f0f7af946458a11eb2727e
x-backend-name: LA_nlb203
x-served-by: cache-iad-kjyo7100166-IAD, cache-iad-kiad7000085-IAD, cache-lax-kwhp1940035-LAX, cache-iad-kiad7000131-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 24 Nov 2023 23:53:39 GMT
server: nginx
surrogate-reporting: width=1024,height=512,bytes=96708,owidth=1024,oheight=733,obytes=190995
x-timer: S1702438753.576159,VS0,VE2
etag: "a0f12e401cebb5be862ddcd8d187efa1"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 115, 1

GET
H2 200 d126473e394e98865383b10e537edd8f.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 29 KB
30 KB 37ms
37ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d126473e394e98865383b10e537edd8f.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: fa0927c576fef771bfd6c3c1bc42f0e860d0de135281c47c43f115a36e068539

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d126473e394e98865383b10e537edd8f.png
age: 4804151
edge-cache-tag: 539210902492927692742835379311962421630,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 539210902492927692742835379311962421630,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 570
expiration: expiry-date="Sun, 22 Oct 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://cdn.taboola.com/
content-length: 29886
x-backend-name: CH_nlb804
x-served-by: cache-iad-kjyo7100046-IAD, cache-iad-kjyo7100053-IAD, cache-iad-kjyo7100153-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 21 Sep 2023 02:11:17 GMT
server: nginx
surrogate-reporting: width=1377,height=765,bytes=77466,owidth=1525,oheight=765,obytes=1134379
x-timer: S1702438753.585218,VS0,VE1
etag: "a8d7ec943ad4efc90b5ca3a42f4635a9"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1, 29306, 1

GET
H2 200 bc82403594b00f595fbe5d00b461baef.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 32 KB
33 KB 40ms
40ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bc82403594b00f595fbe5d00b461baef.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e4cab87e441334fe838e9c0781843c580d01eb26735fc1d1fe83205b7c5506c4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 3
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bc82403594b00f595fbe5d00b461baef.png
age: 3612368
edge-cache-tag: 542168430524927073506661066427688148256,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 542168430524927073506661066427688148256,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 484
req-referer: https://www.atlantanewsfirst.com/
content-length: 32652
x-request-id: bb6c7467d05e789da61da849e124f394
x-backend-name: LA_nlb202
x-served-by: cache-iad-kcgs7200050-IAD, cache-iad-kcgs7200050-IAD, cache-lax-kwhp1940102-LAX, cache-iad-kcgs7200147-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 06 Oct 2023 08:59:39 GMT
server: nginx
surrogate-reporting: width=1000,height=555,bytes=32521,owidth=1000,oheight=600,obytes=467606
x-timer: S1702438753.585198,VS0,VE3
etag: "a532ba549657bbf40c5a9429153b8ae1"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 4, 1, 42, 1

GET
H2 200 cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB1M2xkbmwwMDAwM2I2aHMwc2FhdzVr-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHUxajgxMjAwN3cyNnA0YWd4OGg1aHg.jpg%3Fw%3D1024%26h%3D683
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/ 51 KB
52 KB 37ms
37ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB1M2xkbmwwMDAwM2I2aHMwc2FhdzVr-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHUxajgxMjAwN3cyNnA0YWd4OGg1aHg.jpg%3Fw%3D1024%26h%3D683
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 679ce68034cea00784477121c718acf17cf539e01d88a879984898e51b58736d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB1M2xkbmwwMDAwM2I2aHMwc2FhdzVr-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHUxajgxMjAwN3cyNnA0YWd4OGg1aHg.jpg%3Fw%3D1024%26h%3D683
age: 474842
edge-cache-tag: 359001623193877503262185444201222177276,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 359001623193877503262185444201222177276,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time: 679
req-referer: https://www.mercurynews.com/
content-length: 52506
x-request-id: c13ba4b91f693ca80ea4c250d956bce0
x-backend-name: CH_nlb801
x-served-by: cache-iad-kjyo7100073-IAD, cache-iad-kiad7000044-IAD, cache-lga21968-LGA, cache-iad-kcgs7200108-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 07 Dec 2023 15:45:11 GMT
server: nginx
surrogate-reporting: width=1024,height=569,bytes=49940,owidth=1024,oheight=683,obytes=71982
x-timer: S1702438753.594915,VS0,VE2
etag: "ff83796ca0a5947e253a322eaa3f95b2"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 1, 84, 1

GET
H2 200 BNG-L-49ERS-1211-109.jpg%3Fw%3D1024%26h%3D799
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/ 57 KB
58 KB 50ms
50ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/BNG-L-49ERS-1211-109.jpg%3Fw%3D1024%26h%3D799
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 61f1cda2aafbb797554d9f8ab098e14b7f3be7b4ded9d918efa41bd6026bd7a9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 12
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/BNG-L-49ERS-1211-109.jpg%3Fw%3D1024%26h%3D799
age: 18884
edge-cache-tag: 417845109054924163795742466868732022978,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 417845109054924163795742466868732022978,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 892
req-referer: https://www.mercurynews.com/
content-length: 58110
x-request-id: a4645e77af6916c9014fe73a4a4ccb6a
x-backend-name: US_nlb105
x-served-by: cache-iad-kiad7000113-IAD, cache-iad-kjyo7100048-IAD, cache-ewr18141-EWR, cache-iad-kcgs7200048-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 22:24:29 GMT
server: nginx
surrogate-reporting: width=1024,height=569,bytes=63973,owidth=1024,oheight=798,obytes=126556,ef=(1,13,17,23,30)
x-timer: S1702438753.594892,VS0,VE12
etag: "1524956c157e896a6e2fd1445474d835"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 0, 3, 1

GET
H2 200 BNG-L-WARRIORS-1201-31.jpg%3Fw%3D1024%26h%3D812
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/ 57 KB
58 KB 40ms
39ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/BNG-L-WARRIORS-1201-31.jpg%3Fw%3D1024%26h%3D812
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b5b35f5aa7d2d9de7a150c3696f2dc22d1e03f7dd2ac10d57b9f6910dcd2b97f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/BNG-L-WARRIORS-1201-31.jpg%3Fw%3D1024%26h%3D812
age: 18293
edge-cache-tag: 333789215875821505625807126607551899823,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 333789215875821505625807126607551899823,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 403
req-referer: https://www.mercurynews.com/
content-length: 58634
x-request-id: b0ae0e4733954a45b472fc73bf359b55
x-backend-name: LA_nlb203
x-served-by: cache-iad-kjyo7100150-IAD, cache-iad-kjyo7100147-IAD, cache-lax-kwhp1940048-LAX, cache-iad-kiad7000046-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 22:34:19 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=63675,owidth=1024,oheight=811,obytes=129774,ef=(1,13,17,23,30)
x-timer: S1702438753.612940,VS0,VE2
etag: "c351d482c6a1a4e7db4ea61485734e5a"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1, 15, 1

GET
H2 200 AP22348633844003.jpg%3Fw%3D1024%26h%3D680
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/12/ 83 KB
83 KB 34ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/12/AP22348633844003.jpg%3Fw%3D1024%26h%3D680
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: c7883db3529a1408bcc40ca97dd7c374cb683cab4bcbb6745cad5764fb8ab921

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/12/AP22348633844003.jpg%3Fw%3D1024%26h%3D680
age: 2277057
edge-cache-tag: 562583263529485012555526447831463032820,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 562583263529485012555526447831463032820,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 318
req-referer: https://www.mercurynews.com/
content-length: 84714
x-request-id: 5f7a29b843c439e5d2b7d166244d99ab
x-backend-name: US_nlb104
x-served-by: cache-iad-kcgs7200088-IAD, cache-iad-kjyo7100047-IAD, cache-ewr18171-EWR, cache-iad-kiad7000169-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 16 Nov 2023 19:07:11 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=84674,owidth=1024,oheight=680,obytes=145748
x-timer: S1702438753.618384,VS0,VE2
etag: "a6e5f77fc437243cf9cdf459cda7607f"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1, 71, 1

GET
H2 200 adonishoriz.jpg%3Fw%3D395%26h%3D263
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/03/ 24 KB
25 KB 40ms
38ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/03/adonishoriz.jpg%3Fw%3D395%26h%3D263
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 1e09402f1bdc627a7369d34487baf8bbc74dc1740878235a61222dcfd41981ba

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 5
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/03/adonishoriz.jpg%3Fw%3D395%26h%3D263
age: 682590
edge-cache-tag: 437136073845624031565957980368224152899,308584267801082320679967464701618537544,29ecf9b93bbf306179626feeda1fab70
cache-tag: 437136073845624031565957980368224152899,308584267801082320679967464701618537544,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, HIT, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 244
expiration: expiry-date="Sun, 17 Dec 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://www.mercurynews.com/
content-length: 24352
x-backend-name: US_nlb103
x-served-by: cache-iad-kiad7000115-IAD, cache-iad-kiad7000113-IAD, cache-ewr18141-EWR, cache-iad-kcgs7200044-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 16 Nov 2023 20:56:20 GMT
server: nginx
surrogate-reporting: width=1500,height=834,bytes=54848,owidth=395,oheight=263,obytes=31828
x-timer: S1702438753.626550,VS0,VE5
etag: "9126929019582357d5f3924dce4cae4b"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 0, 0, 23, 1

GET
H2 200 e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/ 94 KB
95 KB 34ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 062b8e72bb612905ba62c0dc9cca124e426e4acafce5bd4e20c93479e5cdd043

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
age: 1811704
edge-cache-tag: 621187487363277256754215053997781261661,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 621187487363277256754215053997781261661,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 478
req-referer: https://apnews.com/
content-length: 96128
x-request-id: 96f11fb6ebaf5074b602e1a77e64f3cd
x-backend-name: LA_nlb203
x-served-by: cache-iad-kiad7000170-IAD, cache-iad-kiad7000065-IAD, cache-lax-kwhp1940106-LAX, cache-iad-kcgs7200042-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 22 Nov 2023 04:24:06 GMT
server: nginx
surrogate-reporting: width=1344,height=746,bytes=112030,owidth=1344,oheight=768,obytes=122375
x-timer: S1702438753.627757,VS0,VE2
etag: "638b45c8dbb2321845cd7f8ab2fa1d69"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 0, 26, 1

GET
BLOB 200
OK 5a2ae0c1-212c-44f3-857a-a8c717bee723
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/5a2ae0c1-212c-44f3-857a-a8c717bee723
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
BLOB 200
OK 14e04ef6-5d3f-46bd-b1ec-6805f8f96b37
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/14e04ef6-5d3f-46bd-b1ec-6805f8f96b37
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 038fc0d258a444f90ebed86977570757.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 136 KB
137 KB 34ms
34ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/038fc0d258a444f90ebed86977570757.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b5d86641c178b92e442b47eeb00d9e230a0356cfeea47ad1b9fa602b68a8b69f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/038fc0d258a444f90ebed86977570757.jpg
age: 7209828
edge-cache-tag: 481046977673515010584110319516902791763,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 481046977673515010584110319516902791763,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 666
req-referer: https://d-39730813263339767356.ampproject.net/
content-length: 139274
x-request-id: c6c23143a26c8fb184a0c21d45673fd5
x-backend-name: LA_nlb203
x-served-by: cache-iad-kiad7000103-IAD, cache-iad-kiad7000103-IAD, cache-sna10724-LGB, cache-iad-kjyo7100078-IAD, cache-mia-kmia1760053-MIA
last-modified: Mon, 11 Sep 2023 14:22:25 GMT
server: nginx
surrogate-reporting: width=1000,height=555,bytes=111166,owidth=1000,oheight=600,obytes=519157
x-timer: S1702438753.633380,VS0,VE1
etag: "d0d1a9996076a3a8501c95152aad05da"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 43, 1, 33, 1

GET
H2 200 EBT-L-OAKCOURT-05XX-14.jpg%3Fw%3D1024%26h%3D687
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/05/ 106 KB
107 KB 67ms
66ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/05/EBT-L-OAKCOURT-05XX-14.jpg%3Fw%3D1024%26h%3D687
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b10b8edae456497ee2aa94e33ce0160605baac467544f5c98087bed25c11f7b9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 33
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/05/EBT-L-OAKCOURT-05XX-14.jpg%3Fw%3D1024%26h%3D687
age: 1122631
edge-cache-tag: 324106235239909214401825578070067832011,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 324106235239909214401825578070067832011,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, MISS
x-envoy-upstream-service-time: 614
req-referer: https://www.mercurynews.com/
content-length: 108860
x-request-id: 284a0941d5d970cbde0f323006c7c4d5
x-backend-name: US_nlb105
x-served-by: cache-iad-kcgs7200143-IAD, cache-iad-kjyo7100029-IAD, cache-ewr18136-EWR, cache-iad-kjyo7100052-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 30 Nov 2023 03:48:42 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=96368,owidth=1024,oheight=686,obytes=177605
x-timer: S1702438753.647545,VS0,VE33
etag: "d2d7611ae0bb2d4095a5728d49c25468"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1, 54, 0

GET
H2 200 goldengate-listing.png%3Fw%3D700%26h%3D422
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/ 119 KB
119 KB 36ms
36ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/goldengate-listing.png%3Fw%3D700%26h%3D422
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b9683996aeb4101068895a7f83cab1df2e79f3c712b3937c252c17969f019b7c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 3
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/goldengate-listing.png%3Fw%3D700%26h%3D422
age: 2193870
edge-cache-tag: 577773312199936065737572346003937079892,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 577773312199936065737572346003937079892,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time: 464
req-referer: https://www.mercurynews.com/
content-length: 121568
x-request-id: 69742a1bdcd9597bf4e7df01b7ea2580
x-backend-name: CH_nlb802
x-served-by: cache-iad-kcgs7200137-IAD, cache-iad-kjyo7100148-IAD, cache-lga21982-LGA, cache-iad-kjyo7100124-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 17 Nov 2023 18:14:43 GMT
server: nginx
surrogate-reporting: width=700,height=388,bytes=66660,owidth=700,oheight=422,obytes=590479
x-timer: S1702438753.649738,VS0,VE3
etag: "5f384c53c1716ac2d2f160d2dcc9fb3a"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 1, 12, 1

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 189 B
1 KB 86ms
85ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A12-10%3A00&ts=1702438752469

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

d7639c5c8459456486f734f91660b71c80250f309f7857aa63044013bd7c678f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 169
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: Aaq0DsyRG5ZFzUYTXfhvrvGVZk2-dW0qxE0b_aJHReiKbyC-HvArPQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/11039244145/ 42 B
108 B 100ms
98ms Image
image/gif 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11039244145/?random=1702438750995&cv=11&fst=1702436400000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v898332463&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&frm=0&tiba=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNtj7RT_Z_GBOoik-IX6rMIaZb0SgOs8XRqJ-q-96WfGpKSPp_&random=2166081875&rmt_tld=0&ipr=y

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 recommendations Show response
a869.mercurynews.com/rest/v2/ 16 KB
5 KB 227ms
224ms Script
text/javascript 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/rest/v2/recommendations?storeId=0595003b-1825-43bc-89bd-9877ca21042f&profileId=00429c59-e969-4a8a-9909-edc20e5375b5&frequencyCap=8&itemId=10256073&request=%5B%7B%22id%22%3A1561661563872%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-12-11T03%3A39%3A12.520Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22SAME_CATEGORY%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%2C%7B%22value%22%3A3%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661593537%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-12-11T03%3A39%3A12.520Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22LOOK_ALIKE%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661645802%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-12-11T03%3A39%3A12.520Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22COLLABORATIVE_FILTERING%22%2C%22rampUp%22%3A%22INSTANT%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A1561661684113%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-12-11T03%3A39%3A12.520Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_CTR%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A%22default%22%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-12-11T03%3A39%3A12.520Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3Anull%7D%5D&&callback=bc_json160

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-232-121-20.compute-1.amazonaws.com

Software

- /

Resource Hash

d54a6324ffb6454f3155017afd05010dcc01ac4f11c3418d99c3c2729a916d1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 4561
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
content-type: text/javascript;charset=utf-8
cache-control: no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag: noindex, nofollow
x-amz-cf-id: 9B9_-UEvs1ley7xwVHsNpibmuNe5lZGP8xwdx0QBNz_zp7E_b62csQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/ 2 KB
1 KB 101ms
100ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1702438751465&cv=11&fst=1702438751465&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v898332463&gcd=11l1l1l1l5&dma=0&tcfd=10000&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&hn=www.googleadservices.com&frm=0&tiba=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&us_privacy=1-N-&auid=1602369993.1702438750&uamb=0&uaw=0&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&rfmt=3&fmt=4

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3ade9b1bd745cacd79771d1b6bb45ad80495b2b4f524981719ad604faeda0c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1374
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/Ave14.png%3Fw%3D1024%26h%3D614
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 953fd5feea050a40d2b91062547375b47edc1cd02a88e9215d14a5ad9baf8e22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/Ave14.png%3Fw%3D1024%26h%3D614
age: 1243902
edge-cache-tag: 627189581876985036857010054268331790179,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 627189581876985036857010054268331790179,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 993
req-referer: https://www.mercurynews.com/
content-length: 28136
x-request-id: f809ae0a6c1bac8c5eece49427349868
x-backend-name: CH_nlb801
x-served-by: cache-iad-kiad7000140-IAD, cache-iad-kjyo7100130-IAD, cache-lga21957-LGA, cache-iad-kiad7000037-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 28 Nov 2023 18:07:30 GMT
server: nginx
surrogate-reporting: width=1023,height=568,bytes=37329,owidth=1023,oheight=614,obytes=556915
x-timer: S1702438753.657422,VS0,VE0
etag: "b7089a6bdbcfd4cb0e24b1410eafdef2"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 0, 21, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 65d9d4089e02682fe8f3464f61e77d16dd93c2f99963f9f028ff7b21acb17c2e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
age: 617889
edge-cache-tag: 424083472584467310278589997397055134424,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 424083472584467310278589997397055134424,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 504
req-referer: https://www.mercurynews.com/
content-length: 32372
x-request-id: 8ceb274aee5d7e5c4ef7c5ffeefdd52e
x-backend-name: US_nlb102
x-served-by: cache-iad-kcgs7200088-IAD, cache-iad-kiad7000170-IAD, cache-lga21977-LGA, cache-iad-kiad7000159-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 05 Dec 2023 23:56:43 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=46936,owidth=1024,oheight=699,obytes=69258
x-timer: S1702438753.668343,VS0,VE0
etag: "e622c673938fc8ce2f7fd3dd85f3282e"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 0, 17, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d126473e394e98865383b10e537edd8f.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 26c123d404f14984be617eb47d3bd57e3d750f1a90cbf839da43e9f3de74581e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d126473e394e98865383b10e537edd8f.png
age: 3067627
edge-cache-tag: 539210902492927692742835379311962421630,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 539210902492927692742835379311962421630,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache: MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 227
expiration: expiry-date="Tue, 03 Oct 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://games.espn.com/
content-length: 8070
x-backend-name: CH_nlb803
x-served-by: cache-iad-kcgs7200112-IAD, cache-iad-kjyo7100101-IAD, cache-iad-kjyo7100055-IAD, cache-mia-kmia1760053-MIA
last-modified: Sat, 02 Sep 2023 08:17:10 GMT
server: nginx
surrogate-reporting: width=380,height=212,owidth=1525,oheight=765,obytes=1134379
x-timer: S1702438753.668460,VS0,VE0
etag: "9cbd1ecdcdb303f036b59847943b66cb"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 3, 236

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 5396
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-R...
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-R...

408 B
1 KB

100ms
100ms

Document
text/html

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

63ac843cab94d34202b9daa08d943b38dbb50f5b3cf29b009e71d77d693060dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 408
Content-Type: text/html;charset=ISO-8859-1
Date: Wed, 13 Dec 2023 03:39:12 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: QSJSDVMV3F5P7XMV92HZ

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Wed, 13 Dec 2023 03:39:12 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 7WEWWX1T3PJARJN9DEH8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9f9e6145ea2158d9972fd5e287ed78ee821843a19c4d61fcc02eb8bf39eb87ec

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
age: 465333
edge-cache-tag: 312153743501965851414173133759212135963,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 312153743501965851414173133759212135963,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 450
req-referer: https://www.mercurynews.com/
content-length: 116560
x-request-id: 545fdc14a502fcb3298da7a68a2753c2
x-backend-name: CH_nlb803
x-served-by: cache-iad-kjyo7100154-IAD, cache-iad-kiad7000131-IAD, cache-lga21966-LGA, cache-iad-kcgs7200076-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 07 Dec 2023 18:20:06 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=98380,owidth=1024,oheight=682,obytes=153879
x-timer: S1702438753.676572,VS0,VE0
etag: "425761048296191d1ac649e0bb408320"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 2, 7, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 36c10082ae7a080c08b10540d245094b91756ce6e467e2212e0beb8be0ef9392

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_645%2Cw_1160%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
age: 1820722
edge-cache-tag: 317020479385025417607082963236979735315,408827614211426674112500014738954083413,29ecf9b93bbf306179626feeda1fab70
cache-tag: 317020479385025417607082963236979735315,408827614211426674112500014738954083413,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 512
req-referer: https://www.mercurynews.com/
content-length: 15390
x-request-id: b63e714b623c4c5a51741f9b96b135e7
x-backend-name: US_nlb103
x-served-by: cache-iad-kjyo7100074-IAD, cache-iad-kiad7000073-IAD, cache-ewr18153-EWR, cache-iad-kjyo7100147-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 22 Nov 2023 01:36:00 GMT
server: nginx
surrogate-reporting: width=1160,height=645,bytes=34390,owidth=400,oheight=232,obytes=12810
x-timer: S1702438753.692035,VS0,VE0
etag: "bb2ed77bc0ec6941f1bbf785925080cc"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 723, 1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bc82403594b00f595fbe5d00b461baef.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 8e44547d9edf28f58cf6d3bd7e7b409cceee79d9ea19115b7da7060673ad8f35

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bc82403594b00f595fbe5d00b461baef.png
age: 3582652
edge-cache-tag: 542168430524927073506661066427688148256,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 542168430524927073506661066427688148256,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 99
req-referer: https://www.sciencealert.com/
content-length: 6648
x-request-id: 581ccbccd8026c3174b454d77959d74a
x-backend-name: CH_nlb803
x-served-by: cache-iad-kiad7000073-IAD, cache-iad-kiad7000098-IAD, cache-chi-kigq8000021-CHI, cache-iad-kiad7000031-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 06 Oct 2023 08:59:39 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=9962,owidth=1000,oheight=600,obytes=467606
x-timer: S1702438753.692190,VS0,VE0
etag: "c242a2336342766275f2f9fdaa8ad696"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1, 2063, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9ec7fa777b35448307d9468f83284d9005ec1e6fbdb1bf19077f4b2906adad29

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
age: 1784318
edge-cache-tag: 621187487363277256754215053997781261661,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 621187487363277256754215053997781261661,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 530
req-referer: https://www.macombdaily.com/
content-length: 13272
x-request-id: 7d5fcd15047c1f90eeefbff3d2d143eb
x-backend-name: US_nlb106
x-served-by: cache-iad-kjyo7100164-IAD, cache-iad-kiad7000118-IAD, cache-lga21970-LGA, cache-iad-kjyo7100101-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 22 Nov 2023 04:24:08 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=23342,owidth=1344,oheight=768,obytes=122375
x-timer: S1702438753.713657,VS0,VE0
etag: "9c670959dd1efa31f6b9663d9b840734"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 27, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/038fc0d258a444f90ebed86977570757.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: c39536d88dba4f38bbeaff1274aad0de33d958e70540989c90d6e10d3221841b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/038fc0d258a444f90ebed86977570757.jpg
age: 2496659
edge-cache-tag: 481046977673515010584110319516902791763,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 481046977673515010584110319516902791763,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: MISS, HIT, HIT, HIT
x-envoy-upstream-service-time: 213
req-referer: https://d-2093356943695717428.ampproject.net/
content-length: 43542
x-request-id: c6c23143a26c8fb184a0c21d45673fd5
x-backend-name: CH_nlb804
x-served-by: cache-iad-kiad7000103-IAD, cache-iad-kiad7000151-IAD, cache-iad-kjyo7100108-IAD, cache-mia-kmia1760053-MIA
last-modified: Mon, 11 Sep 2023 14:22:25 GMT
server: nginx
surrogate-reporting: width=1000,height=555,bytes=111166,owidth=1000,oheight=600,obytes=519157
x-timer: S1702438753.714862,VS0,VE0
etag: "d0d1a9996076a3a8501c95152aad05da"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 18, 2

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 153 KB
27 KB 476ms
475ms Fetch
text/plain 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2536280872594&correlator=368057204438995&eid=31079783%2C31080056%2C44780990&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1-N-&iu_parts=8013%2Cmercurynews.com%2Cnews%2Cworld-news%2Csponsorship_1%2Cinterstitial%2Ctop_leaderboard%2Coutstream_video%2Ccube1_rrail_atf&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F5%2C%2F0%2F1%2F2%2F3%2F6%2C%2F0%2F1%2F2%2F3%2F7%2C%2F0%2F1%2F2%2F3%2F8&prev_iu_szs=300x50%7C320x50%2C1x1%2C728x90%7C970x90%7C970x250%2C480x360%2C300x250%7C300x600%7C300x1050%7C160x600&ifi=1&didk=1622125026~356144529~303353385~359666826~302492128&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702438752622&lmt=1702438752&adxs=3085%2C1360%2C1636%2C1597%2C2338&adys=79%2C242%2C368%2C2264%2C728&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C0&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&vis=1&psz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&msz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&fws=3076%2C1028%2C3076%2C1028%2C3076&ohw=1254%2C1%2C1280%2C711%2C304&ga_vid=1754874842.1702438751&ga_sid=1702438753&ga_hid=322855206&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRjpnYeKxjFIAFICCGQSHAoNY3J3ZGNudHJsLm5ldBjpnYeKxjFIAFICCGQSFwoIcnRiaG91c2UY6Z2HisYxSABSAghkEhQKBW9wZW54GOmdh4rGMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRjpnYeKxjFIAFICCGQ.&dlt=1702438749173&idt=2678&prev_scp=pos%3DSponsorship_1%7Cpos%3Dinterstitial%7Cpos%3Dtop_leaderboard%7Cpos%3DOutstream_Video%7Cpos%3DCube1_RRail_ATF&cust_params=htlbidid%3D27454%26is_testing%3Dno%26kv%3Dworld-news%252Cnews%252Ccourts%252Cmidday-wire%252Cnation-world%252Crussia%252Cweird-news%252Capress%26page%3Darticle%26content%3D%26RPN%3D317317717277%26rurl%3D%26articleid%3D10256073%26blueconic%3Dnon-subs&adks=3819095090%2C175604810%2C3149465069%2C1320985182%2C1226252337&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js?cb=31080056

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f9ab01492fb3379e425e351e4f8862aeef9cf98ac0540c69f50b4b4040b980a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27638
x-xss-protection: 0
google-lineitem-id: -2,5366147178,6414071891,5446990210,6159522902
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,138311135276,138453883269,138446574916,138413520352
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a3b06118313f33e64478202cc1369e43.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9C3D 6 KB
3 KB 286ms
98ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a3b06118313f33e64478202cc1369e43.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 13 Dec 2023 03:39:12 GMT
expires: Thu, 12 Dec 2024 03:39:12 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 241 B
514 B 384ms
159ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 35cd81fdeb2b742d81d5e0ed31ae5a04b466cc211443edf660ac68c1f5367f01

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 46cbb607688fd3ab700a2a91a89179e7
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
content-length: 241
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&rid=esp&cc=1

85 B
196 B

74ms
70ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&rid=esp&cc=1
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: e16fcd8f0694467253dcdddc39bf6a918ff0366f557df502e1d0d32d61c358ea

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-xC+S/N+Mn911wmzBOxWJjDlpx+8"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://www.mercurynews.com
location: /esp?url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f197074efb91e4147970d9c52f266e20.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 8034fd3a3c9a0ba6eab03b5206b825f7882e15e4da90608b3cbdfe4045a33c1e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f197074efb91e4147970d9c52f266e20.png
age: 1951779
edge-cache-tag: 581483605587258704110332802552235956860,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 581483605587258704110332802552235956860,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 261
req-referer: https://wgxa.tv/news/state-news/philadelphia-man-and-former-uga-football-player-convicted-in-fatal-georgia-gas-station-robbery-case
content-length: 40960
x-request-id: 29a96bcc3af16847cdfc2d9874969993
x-backend-name: LA_nlb201
x-served-by: cache-iad-kiad7000141-IAD, cache-iad-kjyo7100084-IAD, cache-lax-kwhp1940096-LAX, cache-iad-kjyo7100038-IAD, cache-mia-kmia1760053-MIA
last-modified: Mon, 20 Nov 2023 12:18:38 GMT
server: nginx
surrogate-reporting: width=1000,height=555,bytes=86696,owidth=1000,oheight=563,obytes=1080157
x-timer: S1702438753.715882,VS0,VE0
etag: "732074585fe2153353dd87327d5ef698"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 1, 15, 3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c0d96ff9819d0023e0226e19bb313667.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 3b48a1b3adfe6108516b13e88fa39a9fc3c769776b8339e124946a9b7312d0ac

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c0d96ff9819d0023e0226e19bb313667.jpg
age: 3794393
edge-cache-tag: 585911644301119625494580134240590334988,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 585911644301119625494580134240590334988,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 610
req-referer: https://tamil.mykhel.com/
content-length: 27512
x-request-id: 3259aa6ce0992074b24562f3f9bfac43
x-backend-name: LA_nlb202
x-served-by: cache-iad-kjyo7100128-IAD, cache-iad-kcgs7200105-IAD, cache-sna10730-LGB, cache-iad-kjyo7100033-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 11 Oct 2023 22:46:57 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=34533,owidth=2048,oheight=1366,obytes=775469
x-timer: S1702438753.719531,VS0,VE0
etag: "0e752d3e42baf6282051099bd7ec39c3"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 23, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/daf466f934189032591a689c36ad0653.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 2419070bc341b47696c99a1bb32cd870a023bd4f2aad566477578c1b98fae463

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/daf466f934189032591a689c36ad0653.jpg
age: 1077671
edge-cache-tag: 593790470313336131287894604481256473594,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 593790470313336131287894604481256473594,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 241
req-referer: https://games.espn.com/
content-length: 9818
x-request-id: a3394d53de11dc32ff9bdc5c1a994028
x-backend-name: LA_nlb202
x-served-by: cache-iad-kjyo7100022-IAD, cache-iad-kcgs7200059-IAD, cache-lax-kwhp1940028-LAX, cache-iad-kjyo7100136-IAD, cache-mia-kmia1760053-MIA
last-modified: Sun, 12 Nov 2023 21:32:29 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=16496,owidth=1000,oheight=600,obytes=719554
x-timer: S1702438753.728362,VS0,VE0
etag: "bdfe033acf979a2758d9587f9bcbfa07"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 0, 110, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d28b2e2ba902d0cce80a8c74ec89e12c.jpeg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: fc21b1036df706a8bbb0cbfb27ee7a67878ed073490c58bab4a5892f3febc64d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d28b2e2ba902d0cce80a8c74ec89e12c.jpeg
age: 2398528
edge-cache-tag: 601245163646100537438941613453255915946,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 601245163646100537438941613453255915946,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 470
req-referer: https://www.tag24.de/dresden/lokales/darum-war-gruenen-vorsitzende-ricarda-lang-in-dresden-2932575
content-length: 22532
x-request-id: e1fbd4233a9abcf3a625ad820e9d2207
x-backend-name: LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb204
x-served-by: cache-iad-kiad7000105-IAD, cache-iad-kiad7000135-IAD, cache-sna10734-LGB, cache-iad-kcgs7200046-IAD, cache-mia-kmia1760053-MIA
last-modified: Sun, 20 Aug 2023 21:53:04 GMT
server: nginx
x-timer: S1702438753.728894,VS0,VE0
etag: "ee8c4d65349c274d307412054d909568"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 2906, 2

GET
H2 204 social
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 70ms
68ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/social?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22%22%2C%22hdl%22%3A%22Russian%20man%20flies%20from%20Denmark%20to%20LAX%20with%20no%20ticket%20or%20passport%22%2C%22sec%22%3A%22World%20News%22%2C%22aut%22%3A%5B%22The%20Associated%20Press%22%5D%2C%22img%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2Fwp-content%2Fuploads%2F2023%2F12%2Fsjm-owaway-Charge_165723542.jpg%3Fw%3D1024%22%2C%22v%22%3A15%2C%22pw%22%3Afalse%7D%5D%7D&tim=17%3A39%3A12.709&id=1406&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b50b0ed333453a723506b5038e163e00.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 73b450b4321873ef3c8944c81dec8dfaea13e36a7659b60f0d13f79dfed0684b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b50b0ed333453a723506b5038e163e00.png
age: 1181921
edge-cache-tag: 332756915896506759957712898242194238422,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
cache-tag: 332756915896506759957712898242194238422,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 107
req-referer: https://www.tips-and-tricks.co/
content-length: 32872
x-request-id: 20c7a5562d491d9afd297ed89c4e7def
x-backend-name: CH_nlb801
x-served-by: cache-iad-kcgs7200138-IAD, cache-iad-kjyo7100060-IAD, cache-lga21960-LGA, cache-iad-kiad7000068-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 29 Nov 2023 10:17:59 GMT
server: nginx
surrogate-reporting: width=580,height=323,bytes=49494,owidth=994,oheight=868,obytes=1662607
x-timer: S1702438753.755648,VS0,VE0
etag: "7da7c65d03ca014dfa84608b81c571a9"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 0, 658, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b4bfa6fd170b7fa85a8f2c67085b9f0c.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: dbcaee63225eb41f4ee33dfeab08533d89d238ecdf3827987fe99be08b83f44a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b4bfa6fd170b7fa85a8f2c67085b9f0c.jpg
age: 2972461
edge-cache-tag: 627692022150049761669145501006249285160,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 627692022150049761669145501006249285160,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 143
expiration: expiry-date="Mon, 06 Nov 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://weather.com/
content-length: 17512
x-backend-name: US_nlb104
x-served-by: cache-iad-kiad7000175-IAD, cache-iad-kiad7000175-IAD, cache-lga21940-LGA, cache-iad-kcgs7200048-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 06 Oct 2023 12:50:11 GMT
server: nginx
surrogate-reporting: width=1200,height=666,bytes=60317,owidth=1200,oheight=675,obytes=152847
x-timer: S1702438753.757542,VS0,VE0
etag: "48351d71ea6d35587b696567298fa441"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3, 1, 2, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/8665cc72ca7b72e8676851cc7e048c0b.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 7e0b70ba3459306fe1de971c4325b63b0a4f46ad8ad37cedd157e314d9878486

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/8665cc72ca7b72e8676851cc7e048c0b.png
age: 3475170
edge-cache-tag: 361678236527001311724946627086440959513,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 361678236527001311724946627086440959513,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 192
req-referer: https://www.businessinsider.com/
content-length: 8394
x-request-id: 3a04497f1f183536972b6f29f040fc6f
x-backend-name: LA_nlb202
x-served-by: cache-iad-kcgs7200061-IAD, cache-iad-kiad7000096-IAD, cache-lax-kwhp1940086-LAX, cache-iad-kcgs7200081-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 02 Nov 2023 18:02:17 GMT
server: nginx
surrogate-reporting: width=932,height=517,bytes=25222,owidth=932,oheight=524,obytes=452446
x-timer: S1702438753.757528,VS0,VE0
etag: "b3f16fc66d530107d9f15377cf5b7d94"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 4, 1, 964, 2

POST
H3 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 100ms
99ms XHR
text/plain 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=322855206&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&dr=&dp=%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&ul=en-us&de=UTF-8&dt=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=6CDACEAjBAAAACgFK~&jid=613429798&gjid=1180079841&cid=1754874842.1702438751&tid=UA-61435456-5&_gid=1999376149.1702438751&_r=1&_slc=1&gtm=45He3bt0n71TLFP4Rv71194413&cd2=mercurynews.com&cd3=mercurynews.com&cd4=&cd5=2023-12-12T17%3A34%3A51-08%3A00&cd6=2023-12-12T17%3A34%3A51-08%3A00&cd7=2023-12-12T17%3A34%3A51-08%3A00&cd9=no&cd10=World%20News&cd11=6.4.2&cd12=&cd13=WP&cd14=World%20News&cd15=World%20News&cd16=News&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&cd22=russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&cd23=10256073&cd24=article&cd25=BANG&cd26=The%20Associated%20Press&cd27=Russian%20man%20flies%20from%20Denmark%20to%20LAX%20with%20no%20ticket%20or%20passport&cd28=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&cd29=Russian%20man%20flies%20from%20Denmark%20to%20LAX%20with%20no%20ticket%20or%20passport&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=BayAreaNewsGroup&cd34=true&cd35=Russia%2C%20Denmark%2C%20Copenhagen%2C%20stowaway%2C%20federal%20charges%2C&cd36=2627&cd37=424&cd38=The%20Associated%20Press&cd42=Not%20Set&cd49=false&cd50=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F120.0.6099.71%20Safari%2F537.36&cd51=&cd54=no_email&cd55=no_affiliation&cd61=Not%20Set&cd62=free&cd63=Not%20Set&cd64=World%20News%2CNews&cd65=The%20Mercury%20News&cd67=None&cd68=None&cd69=None&cd70=None&cd71=None&cd72=none&cd73=none&gcs=G1--&gcd=11l1l1l1l5&dma=0&tcfd=10000&cd53=1754874842.1702438751&z=69488812

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a610f4421288d6ca962444ac4054c395.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ed2c4e3ffdcdaf77e515923ea1c04487199e06c7ca9bf2dc4501da242816fed4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a610f4421288d6ca962444ac4054c395.jpg
age: 1168909
edge-cache-tag: 459176240468581745913164843815447083800,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 459176240468581745913164843815447083800,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 211
expiration: expiry-date="Tue, 14 Nov 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://www.denverpost.com/
content-length: 18212
x-backend-name: US_nlb103
x-served-by: cache-iad-kjyo7100124-IAD, cache-iad-kiad7000160-IAD, cache-iad-kiad7000088-IAD, cache-mia-kmia1760053-MIA
last-modified: Sat, 14 Oct 2023 18:41:29 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=26317,owidth=1000,oheight=600,obytes=139974
x-timer: S1702438753.757494,VS0,VE0
etag: "2d17d064c064f52b5fa5793b69cc5d02"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 20893, 2

GET
H2 200 1696506373_7bbf6f64236a19161a1caed1743c4fc0bd915883.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//www.misterstory.com/afbeeldingen/1200x630/ 20 KB
21 KB 36ms
35ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//www.misterstory.com/afbeeldingen/1200x630/1696506373_7bbf6f64236a19161a1caed1743c4fc0bd915883.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 019b6cbc4194fd6066b4ce302bcf0a6293b9e1e9eac2396dd71fdd9c3366edbc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//www.misterstory.com/afbeeldingen/1200x630/1696506373_7bbf6f64236a19161a1caed1743c4fc0bd915883.png
age: 2465083
edge-cache-tag: 419344205928490594007090446534674992200,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag: 419344205928490594007090446534674992200,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 216
expiration: expiry-date="Sat, 18 Nov 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://apnews.com/
content-length: 20190
x-backend-name: CH_nlb801
x-served-by: cache-iad-kcgs7200146-IAD, cache-iad-kjyo7100097-IAD, cache-chi-kigq8000123-CHI, cache-iad-kiad7000139-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 18 Oct 2023 17:17:52 GMT
server: nginx
surrogate-reporting: width=380,height=212,bytes=31852,owidth=1200,oheight=630,obytes=1082015
x-timer: S1702438753.769635,VS0,VE0
etag: "3c94fc45f0a36e3cf4432f9bffda4727"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 210, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f4ec36824e2cfa2f172a3b969aa5482e73876d5f9698cc8e8920fc524ac26800

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/09/SJM-L-HARASSMENT-0416.jpg%3Fw%3D400%26h%3D232
age: 1821122
edge-cache-tag: 317020479385025417607082963236979735315,588110943443000055148103821789501219624,29ecf9b93bbf306179626feeda1fab70
cache-tag: 317020479385025417607082963236979735315,588110943443000055148103821789501219624,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 793
req-referer: https://www.mercurynews.com/
content-length: 19592
x-request-id: 97f2a2dfb0448398b920d7acb4cf053e
x-backend-name: CH_nlb802
x-served-by: cache-iad-kcgs7200143-IAD, cache-iad-kiad7000142-IAD, cache-lga21937-LGA, cache-iad-kiad7000118-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 22 Nov 2023 01:36:00 GMT
server: nginx
surrogate-reporting: width=1500,height=750,bytes=44728,owidth=400,oheight=232,obytes=12810
x-timer: S1702438753.769628,VS0,VE0
etag: "226eb2bab1419e1206e1a5972b055ef8"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 226, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/Ave14.png%3Fw%3D1024%26h%3D614
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: bd7b908e8b830319aaa966a643d9cd8a9ecfcc16955ac11ede466237ffcb89eb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/Ave14.png%3Fw%3D1024%26h%3D614
age: 1242519
edge-cache-tag: 627189581876985036857010054268331790179,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag: 627189581876985036857010054268331790179,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 1042
req-referer: https://www.mercurynews.com/
content-length: 35698
x-request-id: 54d5d430f9d237accc7ae50b3c86ce70
x-backend-name: CH_nlb804
x-served-by: cache-iad-kiad7000142-IAD, cache-iad-kcgs7200031-IAD, cache-lga21971-LGA, cache-iad-kjyo7100173-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 28 Nov 2023 18:07:29 GMT
server: nginx
surrogate-reporting: width=1023,height=511,bytes=35285,owidth=1023,oheight=614,obytes=556915
x-timer: S1702438753.798131,VS0,VE0
etag: "7ae4e360d9f97429cb9e06fb614c5e65"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 16, 2

GET
H2 200 cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/ 39 KB
40 KB 34ms
33ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f4b99363ef9645733f2edbf0de488bdbd9833884e8b92bd368bc92aed9e8bb92

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHBzdTlnMjgwMDBvM2I2aGZreXhqY3Fp-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHN1MzVrdTAwMjYyNnFmMXQ4eTVzaGY.jpg%3Fw%3D1024%26h%3D700
age: 618150
edge-cache-tag: 424083472584467310278589997397055134424,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag: 424083472584467310278589997397055134424,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time: 607
req-referer: https://www.mercurynews.com/
content-length: 39652
x-request-id: b148cb7b734e6d72c42c3ab1ba5111b9
x-backend-name: CH_nlb801
x-served-by: cache-iad-kcgs7200134-IAD, cache-iad-kcgs7200065-IAD, cache-lga21953-LGA, cache-iad-kjyo7100054-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 05 Dec 2023 23:56:43 GMT
server: nginx
surrogate-reporting: width=1024,height=512,bytes=39121,owidth=1024,oheight=699,obytes=69258
x-timer: S1702438753.798333,VS0,VE0
etag: "b42c014435f5667023d2a5885e6e9e0a"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 1, 7, 2

GET
H2 200 cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/ 124 KB
125 KB 37ms
36ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b6034abcaf2e9d117fa7536d1bf38ab061e262af605e404e8936fba08251bb69

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB0eHJwdGIwMDNjMzU2aHZzMnB2Zzd4-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHR3a25odzAwNWMyNnA0Y2cxeDBubnc.jpg%3Fw%3D1024%26h%3D682
age: 465546
edge-cache-tag: 312153743501965851414173133759212135963,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag: 312153743501965851414173133759212135963,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 1462
req-referer: https://www.mercurynews.com/
content-length: 126802
x-request-id: 499864f332a840fd839292bc6b6c9063
x-backend-name: CH_nlb804
x-served-by: cache-iad-kiad7000124-IAD, cache-iad-kjyo7100053-IAD, cache-lga21930-LGA, cache-iad-kjyo7100040-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 07 Dec 2023 18:20:06 GMT
server: nginx
surrogate-reporting: width=1024,height=512,bytes=81779,owidth=1024,oheight=682,obytes=153879
x-timer: S1702438753.798588,VS0,VE0
etag: "cb16493df22b50cf3a96a96d6d07fb48"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 342, 2

POST
H3 200 collect
www.google-analytics.com/ 35 B
55 B 97ms
97ms Ping
image/gif 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect
www.google-analytics.com/ 35 B
55 B 98ms
97ms Ping
image/gif 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 article-detection.20231212-21-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 3 KB
2 KB 38ms
33ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/article-detection.20231212-21-RELEASE.es6.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b76d9ae1a8521c477d3d74eb1bcdc751605897d2722a5fa9a09cd1d14ad16d7d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: MDpA06fo5.b5rev69U9bmgiUWJHbPbTL
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:12 GMT
x-amz-request-id: J1PWD3JADT34XKY3
age: 46606
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 1291
x-amz-id-2: xrzQwaXtd5KI5v4tP3hGVUx4nuIv8BQBaawXfDcyQo3CGMrvmJ4C/cKgNqkSdbhOS0jyblw3EDM=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 14:40:42 GMT
server: AmazonS3
x-timer: S1702438753.768671,VS0,VE0
etag: "79a0a491a79a14c8fd85f650bd891bb0"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 97
access-control-allow-origin: *
cache-control: private,max-age=2629743
accept-ranges: bytes
x-cache-hits: 53885

GET
H2 200 userx.20231212-21-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 17 KB
6 KB 40ms
35ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/userx.20231212-21-RELEASE.es6.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b8eb81501a03d00eff3546f1eb345c73aa1654d1124e77d40fc6a054a1cf2efb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: N_6PpflamSSBkt.7xarWSBZjQ5yNzKGh
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:12 GMT
x-amz-request-id: XQ4C8F8KSC2V7XXP
age: 46747
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: PENDING
content-length: 5398
x-amz-id-2: 5jsATgfzJuQGsURH/Osvn+9oKbt75DLgbj8CKLzfijPYSH68p94wpUcqpqvedETwyvulQnd5OEE=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 14:39:51 GMT
server: AmazonS3
x-timer: S1702438753.769694,VS0,VE0
etag: "595882519f5fbc29ee0bbcc9c91f6400"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 27
access-control-allow-origin: *
cache-control: private,max-age=2629743
accept-ranges: bytes
x-cache-hits: 8260

GET
H2 200 distance-from-article.20231212-21-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 2 KB
2 KB 40ms
36ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/distance-from-article.20231212-21-RELEASE.es6.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2087c75e9b4a10e0de0a12199c416c0f54c1b1d3b3e2423f1708a9bc4474fe99

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: 1DzipOoxjN.Fah2jfLAOqpOQQbzFnLWn
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:12 GMT
x-amz-request-id: J1PVEQXVCWDFKEMB
age: 46606
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 1132
x-amz-id-2: ArXQnLuBLRtI54FarV04Fuux/ByV9qedL2olw3thkHiJCafAGk5CT5Q+SvpC81OOzoKUm8qckDs=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 14:40:34 GMT
server: AmazonS3
x-timer: S1702438753.769685,VS0,VE0
etag: "79b8cf218115fbbaafe7d13387e1a55c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 91
access-control-allow-origin: *
cache-control: private,max-age=2629743
accept-ranges: bytes
x-cache-hits: 53886

GET
H/1.1

200
OK

52164
i.liadm.com/s/ Frame 3D08
Redirect Chain

https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D&us_privacy=1-N-
https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3840816935748909997&us_privacy=1-N-
https://x.bidswitch.net/sync?ssp=liveintent&user_id=2bec7ccf-fec8-4839-9b13-fc1f46482504&us_privacy=1-N-
https://x.bidswitch.net/ul_cb/sync?ssp=liveintent&user_id=2bec7ccf-fec8-4839-9b13-fc1f46482504&us_privacy=1-N-
https://t.pswec.com/bsw_sync?ssp=liveintent&bsw_user_id=5a3f1a6b-829a-444b-9541-a9778d3d14bc
https://t.pswec.com/ul_cb/bsw_sync?ssp=liveintent&bsw_user_id=5a3f1a6b-829a-444b-9541-a9778d3d14bc
https://x.bidswitch.net/sync?dsp_id=2&user_id=d8f31c65-9c77-4411-a1eb-7a5388615422&expires=3&user_group=1&ssp=liveintent
https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=5a3f1a6b-829a-444b-9541-a9778d3d14bc

43 B
643 B

58ms
58ms

Image
image/gif

34.232.121.20
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=5a3f1a6b-829a-444b-9541-a9778d3d14bc

Requested by

Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?duid=f107d3ac6b63--01hhgm3jp4b3510ykvt3etkph9&euns=0&s=&us_privacy=1-N-&gpp_s=DBACOe~CP2uYgAP2uYgAEXeBAENDeEwAP_gAEPgACiQGgwFQAFAANAAyABwAEAAJAAaAA9ACgAFsANAAhIBHAEeAKQAVoBAACDgKiAXmAxkBoIF5wCgAMgAcABAADQANAAhABHAEAAIOAvMAAAA~BP2uYgAP2uYgAEXeBAENDeCgAf_AAIfAAAaDAVAAUAA0ADIAHAAQAAkABoAD0AKAAWwA0ACEgEcAR4ApABWgEAAIOAqIBeYDGQGggXnAKAAyABwAEAANAA0ACEAEcAQAAg4C8w~1-N-&gpp_as=6&version=v2.11.2&

Protocol

HTTP/1.1

Server

34.232.121.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:14 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 0
Content-Type: image/gif

Redirect headers

Location: //i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=5a3f1a6b-829a-444b-9541-a9778d3d14bc
Date: Wed, 13 Dec 2023 03:39:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

sync
pippio.com/api/ Frame 3D08
Redirect Chain

https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=2bec7ccf-fec8-4839-9b13-fc1f46482504&us_privacy=1-N-
https://p.rfihub.com/cm?pub=39342&in=1&userid=bf8b4f77-4e35-40dc-8ed7-57f39c56ac2d%3A1702438753.0047262&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3Dbf8b4f77-4e35-40dc...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=970033170794683279&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3Dbf8b4f7...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=bf8b4f77-4e35-40dc-8ed7-57f39c56ac2d%3A1702438753.0047262&pid=500040&it=1&iv=bf8b4f77-4e35-40dc-8ed7-57f39c56ac2d%3A1702438753.0047262&_=170...
https://pippio.com/api/sync?it=1&pid=500040&_=1702438753.0067592&iv=bf8b4f77-4e35-40dc-8ed7-57f39c56ac2d:1702438753.0047262

42 B
571 B

178ms
78ms

Image
image/gif

107.178.254.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1702438753.0067592&iv=bf8b4f77-4e35-40dc-8ed7-57f39c56ac2d:1702438753.0047262
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?duid=f107d3ac6b63--01hhgm3jp4b3510ykvt3etkph9&euns=0&s=&us_privacy=1-N-&gpp_s=DBACOe~CP2uYgAP2uYgAEXeBAENDeEwAP_gAEPgACiQGgwFQAFAANAAyABwAEAAJAAaAA9ACgAFsANAAhIBHAEeAKQAVoBAACDgKiAXmAxkBoIF5wCgAMgAcABAADQANAAhABHAEAAIOAvMAAAA~BP2uYgAP2uYgAEXeBAENDeCgAf_AAIfAAAaDAVAAUAA0ADIAHAAQAAkABoAD0AKAAWwA0ACEgEcAR4ApABWgEAAIOAqIBeYDGQGggXnAKAAyABwAEAANAA0ACEAEcAQAAg4C8w~1-N-&gpp_as=6&version=v2.11.2&
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

Location: https://pippio.com/api/sync?it=1&pid=500040&_=1702438753.0067592&iv=bf8b4f77-4e35-40dc-8ed7-57f39c56ac2d:1702438753.0047262
Date: Wed, 13 Dec 2023 03:39:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 2

GET
H/1.1

200
OK

35759
i6.liadm.com/s/ Frame 3D08
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1-N-
https://match.adsrvr.org/track/cmb/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1-N-
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c

43 B
548 B

250ms
60ms

Image
image/gif

2600:1f18:ed:550a:d841:86f3:5054:f043
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c

Requested by

Protocol

HTTP/1.1

Server

2600:1f18:ed:550a:d841:86f3:5054:f043 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:13 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 0
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
Date: Wed, 13 Dec 2023 03:39:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 0

GET
H2

200

live_intent_sync
x.dlx.addthis.com/e/ Frame 3D08
Redirect Chain

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=2bec7ccf-fec8-4839-9b13-fc1f46482504&us_privacy=1-N-
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=2bec7ccf-fec8-4839-9b13-fc1f46482504&us_privacy=1-N-&rd=Y

43 B
595 B

137ms
137ms

Image
image/gif

23.43.252.214
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=2bec7ccf-fec8-4839-9b13-fc1f46482504&us_privacy=1-N-&rd=Y

Requested by

Protocol

Server

23.43.252.214 Newark, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-43-252-214.deploy.static.akamaitechnologies.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Wed, 13 Dec 2023 03:39:13 GMT
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 43
content-type: image/gif

Redirect headers

location: https://x.dlx.addthis.com/e/live_intent_sync?na_exid=2bec7ccf-fec8-4839-9b13-fc1f46482504&us_privacy=1-N-&rd=Y
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 0
expires: Wed, 13 Dec 2023 03:39:13 GMT

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 3D08 43 B
363 B 270ms
70ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@&us_privacy=1-N-

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 441304
expires: Wed, 13 Dec 2023 00:00:00 GMT

GET
H2 200 ibs:dpid=127444&dpuuid=2bec7ccf-fec8-4839-9b13-fc1f46482504
dpm.demdex.net/ Frame 3D08 42 B
714 B 61ms
60ms Image
image/gif 34.234.28.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=127444&dpuuid=2bec7ccf-fec8-4839-9b13-fc1f46482504?us_privacy=1-N-

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.234.28.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-234-28-111.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

dcs: dcs-prod-va6-1-v053-0fcd47c02.edge-va6.demdex.com 2 ms
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: NlpIkm/oRwE=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK img
sync.mathtag.com/sync/ Frame 3D08 43 B
589 B 238ms
75ms Image
image/gif 216.200.232.249
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.mathtag.com/sync/img?mt_exid=36&2bec7ccf-fec8-4839-9b13-fc1f46482504&us_privacy=1-N-
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?duid=f107d3ac6b63--01hhgm3jp4b3510ykvt3etkph9&euns=0&s=&us_privacy=1-N-&gpp_s=DBACOe~CP2uYgAP2uYgAEXeBAENDeEwAP_gAEPgACiQGgwFQAFAANAAyABwAEAAJAAaAA9ACgAFsANAAhIBHAEeAKQAVoBAACDgKiAXmAxkBoIF5wCgAMgAcABAADQANAAhABHAEAAIOAvMAAAA~BP2uYgAP2uYgAEXeBAENDeCgAf_AAIfAAAaDAVAAUAA0ADIAHAAQAAkABoAD0AKAAWwA0ACEgEcAR4ApABWgEAAIOAqIBeYDGQGggXnAKAAyABwAEAANAA0ACEAEcAQAAg4C8w~1-N-&gpp_as=6&version=v2.11.2&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 216.200.232.249 Frederick, United States, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 1237 600843f master ord ord-pixel-x49 config_version:"3667" /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:13 GMT
Server: MT3 1237 600843f master ord ord-pixel-x49 config_version:"3667"
Content-Type: image/gif
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 43
Expires: Wed, 13 Dec 2023 03:39:12 GMT

GET
H2 200 feed-card-placeholder.20231212-21-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 5 KB
1 KB 35ms
34ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/feed-card-placeholder.20231212-21-RELEASE.es6.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9940124c8e26971b2d031e18198f133fa13135f273af11375a9aceedd2098977

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: UV4MOINglbTaaXWvk8Lxl59xKhh4ViI6
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:12 GMT
x-amz-request-id: VK2RPKX8MY4MCQZB
age: 45907
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 1263
x-amz-id-2: 9O34GUJqRpLqdHAH1rLWpuSGXmg78jCzzOacGYCaLkfGcxGmrzOcQmfwB61p+0qY8wWvmJ6kuOQ=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 14:40:26 GMT
server: AmazonS3
x-timer: S1702438753.775052,VS0,VE0
etag: "004224d8e8effe265f1ecc18f4de3347"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 9
access-control-allow-origin: *
cache-control: private,max-age=2629743
accept-ranges: bytes
x-cache-hits: 51533

GET
H2 200 explore-more.20231212-21-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 26 KB
8 KB 35ms
35ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/explore-more.20231212-21-RELEASE.es6.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: db569841a0cddf57b05070e88772af707fcc3671a54464615a2541c92c9a2836

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: wNXpM1IPolIWtyUhJDXpdI9wjvkUY_BU
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:12 GMT
x-amz-request-id: VGKH6G0GVFKSRKDF
age: 45529
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 7707
x-amz-id-2: oXn676BlqNk93jtPUa8VWWEj2IfIAqFvi1FgknaqOeonicyHyXd7r4XU15s+AIcNjJZVH+d9dkQ=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 14:40:29 GMT
server: AmazonS3
x-timer: S1702438753.776009,VS0,VE0
etag: "e3db7be4c17815347b22c776f585d064"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 79
access-control-allow-origin: *
cache-control: private,max-age=2629743
accept-ranges: bytes
x-cache-hits: 25278

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
615 B 95ms
66ms XHR
application/json 54.209.94.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.94.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-94-68.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 6340b4d2c14c1da59e993317bb23803349dfdfe08bf33e99a8272cbba48e8236

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache
x-server: 10.40.54.9
access-control-allow-credentials: true
content-length: 235
expires: 0

GET
H2 200 ats.js Show response
ats-wrapper.privacymanager.io/ats-modules/fc9a1d14-9149-44a9-892e-d1e74cdea32a/ 156 KB
52 KB 270ms
87ms Script
application/javascript 3.161.213.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ats-wrapper.privacymanager.io/ats-modules/fc9a1d14-9149-44a9-892e-d1e74cdea32a/ats.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-96.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9c89b9a334a3e09f983e588c360ae3de01ab7b99fd5e898a7c56af6b552dc06e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: BDSlc2eXoW3Nctq_sSjqm1biHSC3E3NE
content-encoding: gzip
via: 1.1 ddaa088f1b6b5a9bcdc791a053431534.cloudfront.net (CloudFront)
date: Wed, 13 Dec 2023 03:30:55 GMT
last-modified: Wed, 04 Oct 2023 09:43:18 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P1
age: 499
x-amz-server-side-encryption: AES256
etag: W/"52b356a219394893f51dd5f3667c57c1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: must-revalidate,public,max-age=3600
x-amz-cf-id: FBpZldAGYCZkJn5RPRNxY8Gz5sEmvasnaa4WPyblZB42T2KE4EVp6g==

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/12/EBT-L-OAKSHOOT-1210-1.jpeg%3Fw%3D1024%26h%3D733
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 688065685e245f9a2d327022796105c4d85687da5092219b8dc2fc2ca379ed62

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/12/EBT-L-OAKSHOOT-1210-1.jpeg%3Fw%3D1024%26h%3D733
age: 1568458
edge-cache-tag: 601081217774461401803514183276394464289,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag: 601081217774461401803514183276394464289,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 815
req-referer: https://www.mercurynews.com/
content-length: 113676
x-request-id: ffcb00d2e4f0f7af946458a11eb2727e
x-backend-name: LA_nlb203
x-served-by: cache-iad-kjyo7100166-IAD, cache-iad-kiad7000085-IAD, cache-lax-kwhp1940035-LAX, cache-iad-kiad7000131-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 24 Nov 2023 23:53:39 GMT
server: nginx
surrogate-reporting: width=1024,height=512,bytes=96708,owidth=1024,oheight=733,obytes=190995
x-timer: S1702438753.813942,VS0,VE0
etag: "a0f12e401cebb5be862ddcd8d187efa1"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 0, 115, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d126473e394e98865383b10e537edd8f.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: fa0927c576fef771bfd6c3c1bc42f0e860d0de135281c47c43f115a36e068539

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d126473e394e98865383b10e537edd8f.png
age: 4804151
edge-cache-tag: 539210902492927692742835379311962421630,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 539210902492927692742835379311962421630,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 570
expiration: expiry-date="Sun, 22 Oct 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://cdn.taboola.com/
content-length: 29886
x-backend-name: CH_nlb804
x-served-by: cache-iad-kjyo7100046-IAD, cache-iad-kjyo7100053-IAD, cache-iad-kjyo7100153-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 21 Sep 2023 02:11:17 GMT
server: nginx
surrogate-reporting: width=1377,height=765,bytes=77466,owidth=1525,oheight=765,obytes=1134379
x-timer: S1702438753.813942,VS0,VE0
etag: "a8d7ec943ad4efc90b5ca3a42f4635a9"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1, 29306, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bc82403594b00f595fbe5d00b461baef.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e4cab87e441334fe838e9c0781843c580d01eb26735fc1d1fe83205b7c5506c4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bc82403594b00f595fbe5d00b461baef.png
age: 3612368
edge-cache-tag: 542168430524927073506661066427688148256,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 542168430524927073506661066427688148256,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 484
req-referer: https://www.atlantanewsfirst.com/
content-length: 32652
x-request-id: bb6c7467d05e789da61da849e124f394
x-backend-name: LA_nlb202
x-served-by: cache-iad-kcgs7200050-IAD, cache-iad-kcgs7200050-IAD, cache-lax-kwhp1940102-LAX, cache-iad-kcgs7200147-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 06 Oct 2023 08:59:39 GMT
server: nginx
surrogate-reporting: width=1000,height=555,bytes=32521,owidth=1000,oheight=600,obytes=467606
x-timer: S1702438753.813824,VS0,VE0
etag: "a532ba549657bbf40c5a9429153b8ae1"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 4, 1, 42, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB1M2xkbmwwMDAwM2I2aHMwc2FhdzVr-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHUxajgxMjAwN3cyNnA0YWd4OGg1aHg.jpg%3Fw%3D1024%26h%3D683
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 679ce68034cea00784477121c718acf17cf539e01d88a879984898e51b58736d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHB1M2xkbmwwMDAwM2I2aHMwc2FhdzVr-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2NscHUxajgxMjAwN3cyNnA0YWd4OGg1aHg.jpg%3Fw%3D1024%26h%3D683
age: 474842
edge-cache-tag: 359001623193877503262185444201222177276,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 359001623193877503262185444201222177276,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time: 679
req-referer: https://www.mercurynews.com/
content-length: 52506
x-request-id: c13ba4b91f693ca80ea4c250d956bce0
x-backend-name: CH_nlb801
x-served-by: cache-iad-kjyo7100073-IAD, cache-iad-kiad7000044-IAD, cache-lga21968-LGA, cache-iad-kcgs7200108-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 07 Dec 2023 15:45:11 GMT
server: nginx
surrogate-reporting: width=1024,height=569,bytes=49940,owidth=1024,oheight=683,obytes=71982
x-timer: S1702438753.839646,VS0,VE0
etag: "ff83796ca0a5947e253a322eaa3f95b2"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 1, 84, 2

GET
H2 200 BNG-L-49ERS-1211-109.jpg%3Fw%3D1024%26h%3D799
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/ 57 KB
57 KB 36ms
31ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/BNG-L-49ERS-1211-109.jpg%3Fw%3D1024%26h%3D799
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 61f1cda2aafbb797554d9f8ab098e14b7f3be7b4ded9d918efa41bd6026bd7a9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/12/BNG-L-49ERS-1211-109.jpg%3Fw%3D1024%26h%3D799
age: 18884
edge-cache-tag: 417845109054924163795742466868732022978,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 417845109054924163795742466868732022978,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 892
req-referer: https://www.mercurynews.com/
content-length: 58110
x-request-id: a4645e77af6916c9014fe73a4a4ccb6a
x-backend-name: US_nlb105
x-served-by: cache-iad-kiad7000113-IAD, cache-iad-kjyo7100048-IAD, cache-ewr18141-EWR, cache-iad-kcgs7200048-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 22:24:29 GMT
server: nginx
surrogate-reporting: width=1024,height=569,bytes=63973,owidth=1024,oheight=798,obytes=126556,ef=(1,13,17,23,30)
x-timer: S1702438753.839629,VS0,VE0
etag: "1524956c157e896a6e2fd1445474d835"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2, 0, 3, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/BNG-L-WARRIORS-1201-31.jpg%3Fw%3D1024%26h%3D812
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b5b35f5aa7d2d9de7a150c3696f2dc22d1e03f7dd2ac10d57b9f6910dcd2b97f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/11/BNG-L-WARRIORS-1201-31.jpg%3Fw%3D1024%26h%3D812
age: 18293
edge-cache-tag: 333789215875821505625807126607551899823,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 333789215875821505625807126607551899823,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 403
req-referer: https://www.mercurynews.com/
content-length: 58634
x-request-id: b0ae0e4733954a45b472fc73bf359b55
x-backend-name: LA_nlb203
x-served-by: cache-iad-kjyo7100150-IAD, cache-iad-kjyo7100147-IAD, cache-lax-kwhp1940048-LAX, cache-iad-kiad7000046-IAD, cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 22:34:19 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=63675,owidth=1024,oheight=811,obytes=129774,ef=(1,13,17,23,30)
x-timer: S1702438753.845110,VS0,VE0
etag: "c351d482c6a1a4e7db4ea61485734e5a"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1, 15, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/12/AP22348633844003.jpg%3Fw%3D1024%26h%3D680
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: c7883db3529a1408bcc40ca97dd7c374cb683cab4bcbb6745cad5764fb8ab921

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/12/AP22348633844003.jpg%3Fw%3D1024%26h%3D680
age: 2277057
edge-cache-tag: 562583263529485012555526447831463032820,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 562583263529485012555526447831463032820,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 318
req-referer: https://www.mercurynews.com/
content-length: 84714
x-request-id: 5f7a29b843c439e5d2b7d166244d99ab
x-backend-name: US_nlb104
x-served-by: cache-iad-kcgs7200088-IAD, cache-iad-kjyo7100047-IAD, cache-ewr18171-EWR, cache-iad-kiad7000169-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 16 Nov 2023 19:07:11 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=84674,owidth=1024,oheight=680,obytes=145748
x-timer: S1702438753.849288,VS0,VE0
etag: "a6e5f77fc437243cf9cdf459cda7607f"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1, 71, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/03/adonishoriz.jpg%3Fw%3D395%26h%3D263
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 1e09402f1bdc627a7369d34487baf8bbc74dc1740878235a61222dcfd41981ba

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2019/03/adonishoriz.jpg%3Fw%3D395%26h%3D263
age: 682590
edge-cache-tag: 437136073845624031565957980368224152899,308584267801082320679967464701618537544,29ecf9b93bbf306179626feeda1fab70
cache-tag: 437136073845624031565957980368224152899,308584267801082320679967464701618537544,29ecf9b93bbf306179626feeda1fab70
x-cache: Miss from cloudfront, HIT, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time: 244
expiration: expiry-date="Sun, 17 Dec 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://www.mercurynews.com/
content-length: 24352
x-backend-name: US_nlb103
x-served-by: cache-iad-kiad7000115-IAD, cache-iad-kiad7000113-IAD, cache-ewr18141-EWR, cache-iad-kcgs7200044-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 16 Nov 2023 20:56:20 GMT
server: nginx
surrogate-reporting: width=1500,height=834,bytes=54848,owidth=395,oheight=263,obytes=31828
x-timer: S1702438753.853465,VS0,VE0
etag: "9126929019582357d5f3924dce4cae4b"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 0, 0, 23, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 062b8e72bb612905ba62c0dc9cca124e426e4acafce5bd4e20c93479e5cdd043

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/STABLE_DIFFUSION/ESD/e31eb5ba-5b6a-4a13-a73d-381ef202c47e__DvHhMPpt.jpg
age: 1811704
edge-cache-tag: 621187487363277256754215053997781261661,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 621187487363277256754215053997781261661,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time: 478
req-referer: https://apnews.com/
content-length: 96128
x-request-id: 96f11fb6ebaf5074b602e1a77e64f3cd
x-backend-name: LA_nlb203
x-served-by: cache-iad-kiad7000170-IAD, cache-iad-kiad7000065-IAD, cache-lax-kwhp1940106-LAX, cache-iad-kcgs7200042-IAD, cache-mia-kmia1760053-MIA
last-modified: Wed, 22 Nov 2023 04:24:06 GMT
server: nginx
surrogate-reporting: width=1344,height=746,bytes=112030,owidth=1344,oheight=768,obytes=122375
x-timer: S1702438753.853465,VS0,VE0
etag: "638b45c8dbb2321845cd7f8ab2fa1d69"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 0, 26, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/038fc0d258a444f90ebed86977570757.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b5d86641c178b92e442b47eeb00d9e230a0356cfeea47ad1b9fa602b68a8b69f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/038fc0d258a444f90ebed86977570757.jpg
age: 7209828
edge-cache-tag: 481046977673515010584110319516902791763,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 481046977673515010584110319516902791763,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 666
req-referer: https://d-39730813263339767356.ampproject.net/
content-length: 139274
x-request-id: c6c23143a26c8fb184a0c21d45673fd5
x-backend-name: LA_nlb203
x-served-by: cache-iad-kiad7000103-IAD, cache-iad-kiad7000103-IAD, cache-sna10724-LGB, cache-iad-kjyo7100078-IAD, cache-mia-kmia1760053-MIA
last-modified: Mon, 11 Sep 2023 14:22:25 GMT
server: nginx
surrogate-reporting: width=1000,height=555,bytes=111166,owidth=1000,oheight=600,obytes=519157
x-timer: S1702438753.874578,VS0,VE0
etag: "d0d1a9996076a3a8501c95152aad05da"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 43, 1, 33, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/05/EBT-L-OAKCOURT-05XX-14.jpg%3Fw%3D1024%26h%3D687
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b10b8edae456497ee2aa94e33ce0160605baac467544f5c98087bed25c11f7b9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2021/05/EBT-L-OAKCOURT-05XX-14.jpg%3Fw%3D1024%26h%3D687
age: 1122631
edge-cache-tag: 324106235239909214401825578070067832011,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 324106235239909214401825578070067832011,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 614
req-referer: https://www.mercurynews.com/
content-length: 108860
x-request-id: 284a0941d5d970cbde0f323006c7c4d5
x-backend-name: US_nlb105
x-served-by: cache-iad-kcgs7200143-IAD, cache-iad-kjyo7100029-IAD, cache-ewr18136-EWR, cache-iad-kjyo7100052-IAD, cache-mia-kmia1760053-MIA
last-modified: Thu, 30 Nov 2023 03:48:42 GMT
server: nginx
surrogate-reporting: width=1024,height=568,bytes=96368,owidth=1024,oheight=686,obytes=177605
x-timer: S1702438753.883063,VS0,VE0
etag: "d2d7611ae0bb2d4095a5728d49c25468"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1, 54, 1

GET
H2 200 goldengate-listing.png%3Fw%3D700%26h%3D422
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/ 119 KB
120 KB 38ms
34ms Image
image/webp 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/goldengate-listing.png%3Fw%3D700%26h%3D422
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b9683996aeb4101068895a7f83cab1df2e79f3c712b3937c252c17969f019b7c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Wed, 13 Dec 2023 03:39:12 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/goldengate-listing.png%3Fw%3D700%26h%3D422
age: 2193870
edge-cache-tag: 577773312199936065737572346003937079892,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag: 577773312199936065737572346003937079892,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-cache: Miss from cloudfront, MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time: 464
req-referer: https://www.mercurynews.com/
content-length: 121568
x-request-id: 69742a1bdcd9597bf4e7df01b7ea2580
x-backend-name: CH_nlb802
x-served-by: cache-iad-kcgs7200137-IAD, cache-iad-kjyo7100148-IAD, cache-lga21982-LGA, cache-iad-kjyo7100124-IAD, cache-mia-kmia1760053-MIA
last-modified: Fri, 17 Nov 2023 18:14:43 GMT
server: nginx
surrogate-reporting: width=700,height=388,bytes=66660,owidth=700,oheight=422,obytes=590479
x-timer: S1702438753.883385,VS0,VE0
etag: "5f384c53c1716ac2d2f160d2dcc9fb3a"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 1, 12, 2

GET
H3 200 /
www.google.com/pagead/1p-user-list/11039244145/ 42 B
64 B 115ms
111ms Image
image/gif 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11039244145/?random=1702438751465&cv=11&fst=1702436400000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v898332463&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&frm=0&tiba=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&fmt=3&is_vtc=1&cid=CAQSKQDICaaNbEA3WdpwfaRGefevC2n1txzWrbWsBjwabGJTWZbVJIcj185T&random=497842592&rmt_tld=0&ipr=y

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 supply-feature
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 71ms
69ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/supply-feature?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22event_type%22%3A%22distance_from_article%22%2C%22event_state%22%3A%22reported%22%2C%22event_value%22%3A%2265.796875%22%2C%22event_msg%22%3A%22%22%2C%22event_key%22%3A%22%22%7D&tim=17%3A39%3A12.827&id=121&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H3 200 css2
fonts.googleapis.com/ 20 KB
915 B 97ms
96ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a44f5d561cd3e602e092304c1356809a206492fa189be1c11d923e8e768b06b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 13 Dec 2023 03:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:24:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 13 Dec 2023 03:39:12 GMT

GET
H2 204 supply-feature
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 84ms
77ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/supply-feature?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22event_type%22%3A%22EXPLORE_MORE%22%2C%22event_state%22%3A%22AVAILABLE%22%2C%22event_value%22%3A%22%22%2C%22event_msg%22%3A%22%22%2C%22event_key%22%3A%22%22%7D&tim=17%3A39%3A12.842&id=2107&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 abtests
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 78ms
71ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22explore-more%22%2C%22type%22%3A%22header%20found%22%2C%22eventTime%22%3A1702438752853%7D&tim=17%3A39%3A12.853&id=4234&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 supply-feature
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 78ms
72ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/supply-feature?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22event_type%22%3A%22EXPLORE_MORE%22%2C%22event_state%22%3A%22CLICKABLE%22%2C%22event_value%22%3A%22tblOriginalState%3A%20true%22%2C%22event_msg%22%3A%22back%20button%20enabled%2C%20history%20changed.%22%2C%22event_key%22%3A%22%22%7D&tim=17%3A39%3A12.855&id=2918&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 200 mn-logo.svg
www.mercurynews.com/wp-content/uploads/2020/09/ 12 KB
12 KB 41ms
34ms Image
image/svg+xml 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mercurynews.com/wp-content/uploads/2020/09/mn-logo.svg

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
strict-transport-security: max-age=31536000;includeSubdomains
x-rq: mia2 80 130 443
last-modified: Wed, 23 Sep 2020 17:38:16 GMT
server: nginx
etag: "497950346404e2d1"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 12014

GET
H2 204 abtests
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 82ms
76ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22explore-more%22%2C%22type%22%3A%22explore-more-available%22%2C%22eventTime%22%3A1702438752865%7D&tim=17%3A39%3A12.865&id=8528&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 2 B
149 B 69ms
67ms XHR
text/plain 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-61435456-5&cid=1754874842.1702438751&jid=613429798&gjid=1180079841&_gid=1999376149.1702438751&_u=6CDACEAiBAAAACgFK~&z=723730323

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 13 Dec 2023 03:39:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 606600fe-6ef6-41a2-93e5-2f931decfdf8
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/606600fe-6ef6-41a2-93e5-2f931decfdf8
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 238 B
682 B 244ms
234ms XHR
text/javascript 3.161.212.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.212.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-212-32.yul62.r.cloudfront.net

Software

Server /

Resource Hash

b441d0a4b0c48e2c88c98d2a65d2525ccb0bb51d001b51311b0062ea8f9be5f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 4abd8708c8464a6586e6829348c23522.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: YUL62-P1
x-amz-rid: 6HKA6YEXXVZ5P9RC8YTV
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.mercurynews.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 238
x-amz-cf-id: 2HluuKuO3s8mB4PGCNdzTw8URsxrbbLLtx5gAYnKvMhouV94p5zSNQ==

POST
H/1.1 200
OK medianewsgroup Show response
direct.adsrvr.org/bid/bidder/ 0
403 B 71ms
64ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/medianewsgroup
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:12 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

GET
H2 204 prebid Show response
ads.yieldmo.com/exchange/ 0
227 B 67ms
58ms Fetch 52.0.227.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=8.24.0&p=%5B%7B%22placement_id%22%3A%22htlad-12-gpt%22%2C%22callback_id%22%3A%2243189bdcd580447%22%2C%22sizes%22%3A%5B%5B300%2C50%5D%2C%5B320%2C50%5D%5D%2C%22ym_placement_id%22%3A%223263962355775513258%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fsponsorship_1%232%22%2C%22tid%22%3A%226e42e247-d2d9-45c9-bc7d-f0d138760bb9%22%2C%22auctionId%22%3A%22ec7ef800-4d02-437b-ad52-79b35549bc69%22%7D%5D&page_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bust=1702438752958&dnt=false&description=He%20told%20officials%20he%20might%20have%20had%20a%20plane%20ticket%20to%20come%20to%20the%20United%20States%2C%20but%20he%20was%20not%20sure.%20He%20also%20said%20he%20didn%27t%20remember%20how%20he%20got%20through%20security%20in%20Copenhagen%20and%20wouldn%27t%20explain%20what%20he%20was%20doing%20in%20the%20Scandinavian%20city%2C%20according%20to%20the%20complaint.&tmax=1000&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1-N-&pr=&scrd=1&title=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&w=1600&h=1200
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.227.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-227-33.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
access-control-allow-credentials: true
x-robots-tag: none,NOINDEX,NOFOLLOW
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 36 B
334 B 96ms
89ms Fetch
application/json 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=945271
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fdcc3b83781098aa0dc9bb387ff1380e3690308ed0990415436c3fa586fe606c

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=83nilQycqFnI6Hy264jIxD%2FxOVqQG68JMzLLLfhHjhiA9%2FhRb%2Fl8goDbl11kobPSSKzHDaYF65FgS4sl%2BgOFDiNKl1omW2v5dH%2Bn39%2FuoY3bQ2bRLzoleq33f5Ms12JJflpv6qQO"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 834b2dbe2bf39ad2-MIA
alt-svc: h3=":443"; ma=86400
content-length: 36
expires: 0

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
197 B 101ms
97ms Fetch 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.24.0&cb=54287265234&lsavail=1

Requested by

Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
date: Wed, 13 Dec 2023 03:39:12 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
583 B 70ms
68ms Fetch
application/json 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-3-211-79-137.compute-1.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
an-x-request-uuid: 7a272095-6e71-4341-bc29-66bd728ed8e1
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
431 B 63ms
62ms Fetch
application/json 3.209.92.95
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 3.209.92.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-92-95.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: b59875395ac46965dfef4dcc38871389bee08f95b4c20a560b17691f16b00935

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.mercurynews.com
content-type: application/json
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 83

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
759 B 60ms
59ms Fetch
application/json 3.211.79.137
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.211.79.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
accept-ch: sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform
x-auction-status: 12
content-type: application/json; charset=utf-8
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 483 B
540 B 153ms
153ms Fetch
application/json 2602:803:c002:200::114
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768250&size_id=43&alt_size_ids=44&gdpr=0&us_privacy=1-N-&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&kw=Russia%2CDenmark%2CCopenhagen%2Cstowaway%2Cfederalcharges%2C&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fsponsorship_1%232&tk_flint=pbjs_lite_v8.24.0&x_source.tid=ec7ef800-4d02-437b-ad52-79b35549bc69&l_pb_bid_id=5572d5483472ebc&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=6e42e247-d2d9-45c9-bc7d-f0d138760bb9&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fsponsorship_1%232&m_ch_mobile=%3F0&slots=1&rand=0.26141627598949624
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::114 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 84e11789a21a7e2b2a1dad2562e49c75dccb0cb20b394db3b52247aa9fc1f8ca

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 483
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
63 B 93ms
92ms Fetch 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
date: Wed, 13 Dec 2023 03:39:13 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 103ms
99ms Image
image/gif 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-61435456-5&cid=1754874842.1702438751&jid=613429798&_u=6CDACEAiBAAAACgFK~&z=1146649170

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cmOsUnit.css
vidstat.taboola.com/vpaid/units/33_6_6/assets/css/ 60 KB
8 KB 36ms
36ms Stylesheet
text/css 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidstat.taboola.com/vpaid/units/33_6_6/assets/css/cmOsUnit.css
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: 83ecdfb76c38605f0e3538a0a9de0f1e57a457a2dfebe0654ee2f9b13c49a2ec

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-meta-mtime: 1702116162
date: Wed, 13 Dec 2023 03:39:13 GMT
via: 1.1 varnish
content-encoding: br
x-amz-request-id: TDQH1107636KGN2M
age: 322520
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-meta-ctime: 1702116162
x-amz-meta-mode: 33188
content-length: 7924
x-amz-id-2: 5xMMCne036AyoZoIlDV+612WyVEi35Xa3+38WUn/cTq/Z7Tlj5u1nmhyJvHYXFbMgdf17VDm9To=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Sat, 09 Dec 2023 10:02:44 GMT
server: AmazonS3-br
x-timer: S1702438753.029502,VS0,VE0
etag: "a6067988de416f653559cce5285c7c1b"
x-amz-meta-uid: 0
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 19726

GET
H2 200 cmTagRECO_REEL_WIDGET.js Show response
vidstat.taboola.com/vpaid/units/33_6_6/infra/ 500 KB
106 KB 36ms
36ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidstat.taboola.com/vpaid/units/33_6_6/infra/cmTagRECO_REEL_WIDGET.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: 4726805ff98f60c1e0786927a14b878a02694293699173090549c17c8c3cc9f2

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-meta-mtime: 1702116131
date: Wed, 13 Dec 2023 03:39:13 GMT
via: 1.1 varnish
content-encoding: br
x-amz-request-id: GJYE454N84GZ37D7
age: 322508
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-meta-ctime: 1702116131
x-amz-meta-mode: 33188
content-length: 108496
x-amz-id-2: UGc1dYm/FAKmXgP8sV9j2zbQ9M4zhx3fH98gMsoKkA8qAHPrfXXkIWoeQHT3PiFsMQr0Rn1FrBw=
x-served-by: cache-mia-kmia1760049-MIA
last-modified: Sat, 09 Dec 2023 10:02:13 GMT
server: AmazonS3-br
x-timer: S1702438753.030386,VS0,VE0
etag: "c7e30bc05d486dc1a1860046989097d1"
x-amz-meta-uid: 0
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 282

GET
H2 200 st
ch-vid-events.taboola.com/ 0
43 B 71ms
66ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-vid-events.taboola.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=66361655&crid=-1&dast=V8Kq0CLAaweienCtrrEhNg9U5OFbTXJS4AAABgYMD_AEnZdrvBbLdxK4e73Vq08k3WEotz5BauFjPbZDNzmVwTIyAp2243mO02buVwt1uLVr7JWmJxjtzC1WJmm2xmLpNrYgUewTr93Q7Ty2SQtDx-g6TlMhsUFL_tZZCxXCY3QEPT6fC57vW63--udlk-rsvz7vJ97hq_2y8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nP5yAAAAAPDg____HwIAAABABAAAAAAJAAAAABQCKvxbELgAAAAAgOH___9fA8D4BgFnlgOCu3wH5d_y9QcAAAAAEAAAAAAkABBanksAvJxEn_j_________jzFAn3kj4______GQg-ABx8AD0IAAAAuhoSPHQrFGg0oEjlQKcIIAAAAgAmhndGRSTpBxaLK__9_vxWAKwAAAYxhQctbWXQHJd7CAAAAEIxZoIfF7zc77Bq_22X-_________838n_lHIzQyM5NGeBKeVM0vIADAml9AAAA26gYA4E0AnKBD0IrBYHUUYjecLXazxXAyOwAAAAB3_v____WA3GQ12thsK8NiM9vYXMuFxWRzrnyb2cg4mpkms-2RDEGn1HKprujjEazT3-0wvUwGScvjN0haLrNBQfHbXgYZy2WynwlbjFaTyWY5nC0Xk8FwNByN9mcgJoMBmojBcjmZLCa71Wg12gx3o9lggQRiMEEULRpMVqPRZDEZrkaT1Wy52O02iKJVq9loMxiuZpPZbrcaDobL0QhN2GK0mkw2y-FsuZgMhqPhaDREMGQaTAYLj3Gt8g2Ha9HKMXMrVyuTW-JYDBajjWE4GU3cotfH9PFNFh6TzYsEA872InlapBPhzOVy7pazmWPk3ExGs43FZhtZZoPNxDlzTjamiViiOVmkE9ll35usRhubbWVYbGYbm2u5sJhszpVvMxsZRzPTZLYvmQaTwcJjXKt8w-FatHLM3MrVyuSWOBaDxWhjGE5GE7fo9TF9fJOFx2TzN3aDyWgz3K0W-8ZuMBlthrvVYt-hM3xXn7NROlmKPT6vVjRNfmxOg8JlsHinRYu0dTj6jDqvbSJMrU07x8QqtEq8BoXn4FF9TSuJ1G99iLfrjfdgVMQSwUU6UbtMTofd5fv8LH_X4a12WT6uy_Pu8n0uYonSdJFO9JLBZLNXTPaKyV7y-nyeDrtb7bC7ZWany_OWWf5ut8hldzssX7fo7xY7jG_d03R0y_1u0dPjdZneestb8PB8Dn_L6SKWCE4X6UT0Mp4u6j9qmOFcsZnMFYvhXDdYJQAAAAAAAAAASzDJdBMAAAAAJ4PazAaL1TodzGA52AxXywVQoV6jCxgEAAAAAABglxR1LuLY-2ZSscYe02iXyemwu3yfn-XvOrzVLsvHdXneXb7PlQFUpP8w2-wzgljL2bIGAAAggA0AACCA2268CTiz4v7____HAQAAAJBDDwAAwH8f0BAzMzMzczO_ghgMh5P9A1Ah1nK2ut1Yy9kKKFC7CQQACKgH!&cmcv=&pix=31589837&cb=1702438752996&uv=3366&tms=1702438752996&abt=adxsub-out_vA!adxsub-out_vB!DLR_vA!rbcatc_vA!tmaxc_vB&ft=0&unm=RECO_REEL_WIDGET&debug=pn:!sqg:!torgn:1702438749060.6!ts:1702438752995&mntl=1
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
content-length: 0
server: nginx

GET
H2 200 st
imprchmp.taboola.com/ 0
78 B 95ms
67ms Image
text/plain 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imprchmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8Kq0CLAaweienCtrrEhNg9U5OFbTXJS4AAABgYMD_AEnZdrvBbLdxK4e73Vq08k3WEotz5BauFjPbZDNzmVwTIyAp2243mO02buVwt1uLVr7JWmJxjtzC1WJmm2xmLpNrYgUewTr93Q7Ty2SQtDx-g6TlMhsUFL_tZZCxXCY3QEPT6fC57vW63--udlk-rsvz7vJ97hq_2y8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nP5yAAAAAPDg____HwIAAABABAAAAAAJAAAAABQCKvxbELgAAAAAgOH___9fA8D4BgFnlgOCu3wH5d_y9QcAAAAAEAAAAAAkABBanksAvJxEn_j_________jzFAn3kj4______GQg-ABx8AD0IAAAAuhoSPHQrFGg0oEjlQKcIIAAAAgAmhndGRSTpBxaLK__9_vxWAKwAAAYxhQctbWXQHJd7CAAAAEIxZoIfF7zc77Bq_22X-_________838n_lHIzQyM5NGeBKeVM0vIADAml9AAAA26gYA4E0AnKBD0IrBYHUUYjecLXazxXAyOwAAAAB3_v____WA3GQ12thsK8NiM9vYXMuFxWRzrnyb2cg4mpkms-2RDEGn1HKprujjEazT3-0wvUwGScvjN0haLrNBQfHbXgYZy2WynwlbjFaTyWY5nC0Xk8FwNByN9mcgJoMBmojBcjmZLCa71Wg12gx3o9lggQRiMEEULRpMVqPRZDEZrkaT1Wy52O02iKJVq9loMxiuZpPZbrcaDobL0QhN2GK0mkw2y-FsuZgMhqPhaDREMGQaTAYLj3Gt8g2Ha9HKMXMrVyuTW-JYDBajjWE4GU3cotfH9PFNFh6TzYsEA872InlapBPhzOVy7pazmWPk3ExGs43FZhtZZoPNxDlzTjamiViiOVmkE9ll35usRhubbWVYbGYbm2u5sJhszpVvMxsZRzPTZLYvmQaTwcJjXKt8w-FatHLM3MrVyuSWOBaDxWhjGE5GE7fo9TF9fJOFx2TzN3aDyWgz3K0W-8ZuMBlthrvVYt-hM3xXn7NROlmKPT6vVjRNfmxOg8JlsHinRYu0dTj6jDqvbSJMrU07x8QqtEq8BoXn4FF9TSuJ1G99iLfrjfdgVMQSwUU6UbtMTofd5fv8LH_X4a12WT6uy_Pu8n0uYonSdJFO9JLBZLNXTPaKyV7y-nyeDrtb7bC7ZWany_OWWf5ut8hldzssX7fo7xY7jG_d03R0y_1u0dPjdZneestb8PB8Dn_L6SKWCE4X6UT0Mp4u6j9qmOFcsZnMFYvhXDdYJQAAAAAAAAAASzDJdBMAAAAAJ4PazAaL1TodzGA52AxXywVQoV6jCxgEAAAAAABglxR1LuLY-2ZSscYe02iXyemwu3yfn-XvOrzVLsvHdXneXb7PlQFUpP8w2-wzgljL2bIGAAAggA0AACCA2268CTiz4v7____HAQAAAJBDDwAAwH8f0BAzMzMzczO_ghgMh5P9A1Ah1nK2ut1Yy9kKKFC7CQQACKgH!&cmcv=&pix=undefined&cb=1702438752996&uv=3366&tms=1702438752996&abt=adxsub-out_vA!adxsub-out_vB!DLR_vA!rbcatc_vA!tmaxc_vB&ft=0&unm=RECO_REEL_WIDGET&aure=false&agl=1&cirid=e677067c-9877-4e72-bb9d-851f623fed5b&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=false
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 13 Dec 2023 03:39:13 GMT
via: 1.1 varnish
server: nginx
x-timer: S1702438753.063217,VS0,VE32
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-served-by: cache-mia-kmia1760053-MIA

GET
H2 204 abtests
ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 0
504 B 71ms
68ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:CH:V&tvi2=10408&tvi48=10143&tvi50=10882&lti=deflated&ri=5b34396b3275f2e379a9580f71e3f1fd&sd=v2_7254cf6e0136cf59abdf9e736d84f426_d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf_1702438751_1702438751_CNawjgYQtdRXGOWVh4rGMSABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjWiJDT_uCxvzFwAQ&ui=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&pi=/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport&wi=5968599401616087881&pt=text&vi=1702438750949&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22HipLostNoAdjacInFirstWF%22%2C%22type%22%3A%22HipLost%22%2C%22eventTime%22%3A1702438753005%7D&tim=17%3A39%3A13.006&id=2031&llvl=2&cv=20231212-21-RELEASE&
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 200 st Show response
imprchmp.taboola.com/ Frame 8A2E 531 B
397 B 89ms
73ms Document
text/html 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://imprchmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&cmcv=&pix=undefined&cb=1702438753024&uv=3366&tms=1702438753024&abt=adxsub-out_vA!adxsub-out_vB!DLR_vA!rbcatc_vA!tmaxc_vB!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=a0af322a-7ab5-4eee-9474-f577792e0705&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: cad833254591fffdcbe2333614918fb2391323ccd104af75ffb15a1f18a173dd

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-type: text/html;charset=ISO-8859-1
date: Wed, 13 Dec 2023 03:39:13 GMT
server: nginx
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760053-MIA
x-timer: S1702438753.063231,VS0,VE38

GET
H2 200 sync Show response
ch-match.taboola.com/ Frame 7796 531 B
616 B 99ms
68ms Document
text/html 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ch-match.taboola.com/sync?dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&excid=22&docw=0&cijs=1&nlb=false
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: ba5b7cda999aa02f978e307a957e61760c924284b35b324a8e28783b665a55e6

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-type: text/html;charset=ISO-8859-1
date: Wed, 13 Dec 2023 03:39:13 GMT
machineid: 3802
server: nginx

GET
H2 200 cmTagFEED_MANAGER.js Show response
vidstat.taboola.com/vpaid/units/33_6_6/infra/ 603 KB
121 KB 32ms
32ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidstat.taboola.com/vpaid/units/33_6_6/infra/cmTagFEED_MANAGER.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: 5fdad21c88225ca3183feec6ab65d4c4c986a35e6d6ab46ec57fc6e6c8364897

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-meta-mtime: 1702116152
date: Wed, 13 Dec 2023 03:39:13 GMT
via: 1.1 varnish
content-encoding: br
x-amz-request-id: EP4QHJK98D999CTY
age: 322519
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-meta-ctime: 1702116153
x-amz-meta-mode: 33188
content-length: 123361
x-amz-id-2: TA14Y5SxnNliSyivqxqw0FWMy7T0Wf/ZnXAp0SMN3YRvGogOzIslKLpr8kZB77BtALfLeN4rUJk=
x-served-by: cache-mia-kmia1760049-MIA
last-modified: Sat, 09 Dec 2023 10:02:34 GMT
server: AmazonS3-br
x-timer: S1702438753.101881,VS0,VE0
etag: "78362b805537d200921cfcb71c8b2d71"
x-amz-meta-uid: 0
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 15972

GET
H2 200 st
ch-vid-events.taboola.com/ 0
43 B 67ms
67ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-vid-events.taboola.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=66361655&crid=-1&dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&cmcv=&pix=31589837&cb=1702438753024&uv=3366&tms=1702438753024&abt=adxsub-out_vA!adxsub-out_vB!DLR_vA!rbcatc_vA!tmaxc_vB!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&debug=pn:!sqg:!torgn:1702438749060.6!ts:1702438753023&mntl=1
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
content-length: 0
server: nginx

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 28FB 5 KB
5 KB 66ms
65ms Document
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

6d765cec47def50629261cc2bc0fdce298e445df1daf10358625cb206771846c

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 4907
Content-Type: text/html;charset=ISO-8859-1
Date: Wed, 13 Dec 2023 03:39:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: Z1T4K53X6QYVNHWN71PJ

GET
H2

200

/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame 8A2E
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?gdpr=0&ttd_pid=054f32o&us_privacy=1-N-&ttd_tpi=1
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c

0
426 B

63ms
63ms

Image
text/plain

151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
Requested by: Host: imprchmp.taboola.com
URL: https://imprchmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&cmcv=&pix=undefined&cb=1702438753024&uv=3366&tms=1702438753024&abt=adxsub-out_vA!adxsub-out_vB!DLR_vA!rbcatc_vA!tmaxc_vB!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=a0af322a-7ab5-4eee-9474-f577792e0705&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Protocol: H2
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imprchmp.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 31
date: Wed, 13 Dec 2023 03:39:13 GMT
via: 1.1 varnish
x-served-by: cache-mia-kmia1760053-MIA
server: nginx
x-timer: S1702438754.595927,VS0,VE31
x-fastly-to-nlb-rtt: 29975
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-service-version: v1
x-cache-hits: 0

Redirect headers

location: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
date: Wed, 13 Dec 2023 03:39:13 GMT
server: Kestrel
content-length: 239

GET
H2

200

/
sync.taboola.com/sg/medianetrtb-network/1/rtb-h/ Frame 8A2E
Redirect Chain

https://cs.media.net/cksync?cs=69&type=tb&gdpr=0&us_privacy=1-N-&redirect=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fmedianetrtb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%3Cvsid%3E
https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10

0
372 B

357ms
68ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10
Requested by: Host: imprchmp.taboola.com
URL: https://imprchmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&cmcv=&pix=undefined&cb=1702438753024&uv=3366&tms=1702438753024&abt=adxsub-out_vA!adxsub-out_vB!DLR_vA!rbcatc_vA!tmaxc_vB!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=a0af322a-7ab5-4eee-9474-f577792e0705&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imprchmp.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 66554

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:13 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Wed, 13 Dec 2023 03:39:13 GMT

GET
H2

200

/
sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/ Frame 8A2E
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/taboola/d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf?gdpr=0&us_privacy=1-N-
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A

0
373 B

257ms
65ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A
Requested by: Host: imprchmp.taboola.com
URL: https://imprchmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&cmcv=&pix=undefined&cb=1702438753024&uv=3366&tms=1702438753024&abt=adxsub-out_vA!adxsub-out_vB!DLR_vA!rbcatc_vA!tmaxc_vB!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=a0af322a-7ab5-4eee-9474-f577792e0705&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imprchmp.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 66554

Redirect headers

date: Wed, 13 Dec 2023 03:39:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A
content-length: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame D1CF 594 B
805 B 153ms
59ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: bc955cc7e2392b8591d3143820e5df6717c149057f3435ac45e187346958a7b8

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 387
content-type: text/html
date: Wed, 13 Dec 2023 03:39:13 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2

200

/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame 7796
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?gdpr=0&ttd_pid=054f32o&us_privacy=1-N-&ttd_tpi=1
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c

0
65 B

64ms
62ms

Image
text/plain

151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
Requested by: Host: ch-match.taboola.com
URL: https://ch-match.taboola.com/sync?dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&excid=22&docw=0&cijs=1&nlb=false
Protocol: H2
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ch-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 31
date: Wed, 13 Dec 2023 03:39:13 GMT
via: 1.1 varnish
x-served-by: cache-mia-kmia1760053-MIA
server: nginx
x-timer: S1702438754.598041,VS0,VE31
x-fastly-to-nlb-rtt: 30002
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-service-version: v1
x-cache-hits: 0

Redirect headers

location: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
date: Wed, 13 Dec 2023 03:39:13 GMT
server: Kestrel
content-length: 239

GET
H2

200

/
sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/ Frame 7796
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/taboola/d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf?gdpr=0&us_privacy=1-N-
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A

0
372 B

355ms
66ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A
Requested by: Host: ch-match.taboola.com
URL: https://ch-match.taboola.com/sync?dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&excid=22&docw=0&cijs=1&nlb=false
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ch-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 66554

Redirect headers

date: Wed, 13 Dec 2023 03:39:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A
content-length: 0

GET
H2

200

/
sync.taboola.com/sg/medianetrtb-network/1/rtb-h/ Frame 7796
Redirect Chain

https://cs.media.net/cksync?cs=69&type=tb&gdpr=0&us_privacy=1-N-&redirect=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fmedianetrtb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%3Cvsid%3E
https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10

0
372 B

259ms
67ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10
Requested by: Host: ch-match.taboola.com
URL: https://ch-match.taboola.com/sync?dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&excid=22&docw=0&cijs=1&nlb=false
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ch-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 66554

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:13 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Location: https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Wed, 13 Dec 2023 03:39:13 GMT

GET
H2 200 spa-detector.20231212-21-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 2 KB
1 KB 33ms
32ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/spa-detector.20231212-21-RELEASE.es6.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 876a529b3aafe443ac0281e9b4e36df211bf8bae3ef75a7a592f68c681a974ae

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: pA38nxI9YdQwVeN9qkoP2vMJBIsP.seT
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:13 GMT
x-amz-request-id: VGKWEBRWD2A7VGDB
age: 45529
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 779
x-amz-id-2: kps7veJTH7CB7NUMRwrsfsZO3mSqtHz0tHvVFKcVRUGuLkfJdHqre3jpuv42N4slXT8xQBl35p8=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Tue, 12 Dec 2023 14:40:05 GMT
server: AmazonS3
x-timer: S1702438753.213675,VS0,VE0
etag: "abb437d8e5dfbc250c6eec0d65b5574d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 90
access-control-allow-origin: *
cache-control: private,max-age=2629743
accept-ranges: bytes
x-cache-hits: 25772

GET
H2 200 asyncPixelSync Show response
pixel.sitescout.com/dmp/ Frame 7AB0 1 KB
2 KB 58ms
57ms Document
text/html 207.198.113.205
COGECO-PEER1

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.sitescout.com/dmp/asyncPixelSync?gdpr=0
Requested by: Host: 13619678.fls.doubleclick.net
URL: https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CNau7Me-i4MDFYG40QQd0UkPMg;src=13619678;type=retar0;cat=retar0;ord=5552642173764;auiddc=1602369993.1702438750;gtm=45He3bt0v71194413;gcs=G1--;gcd=11l1l1l1l5;dma=0;tcfd=10000;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 207.198.113.205 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: A /
Resource Hash: c7aed6018ad3f2dd2a3192c5800090c5b11c2f32990de8fbbe36c8d1fce9c1fc

Request headers

Referer: https://13619678.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0,no-cache,no-store
content-length: 1151
content-type: text/html;charset=UTF-8
date: Wed, 13 Dec 2023 03:39:12 GMT
expires: Tue, 11 Oct 1977 12:34:56 GMT
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
server: A

GET
H2 200 b-34df212-ae6f9fe2.js Show response
tagan.adlightning.com/mng-trib/ Frame 7E02 68 KB
27 KB 86ms
83ms Script
application/javascript 3.161.213.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-54.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2a287439d841968fbb9edca3c80d9acc3b66897fd273a501ef8588461f8c1cd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 23:09:24 GMT
content-encoding: gzip
via: 1.1 82411d437ee2d2355a407b78473e6156.cloudfront.net (CloudFront)
x-amz-version-id: HDL2ZIRuJOCDdiq95fmqqTRa5yG_hp7B
x-amz-cf-pop: YUL62-P1
age: 1657790
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 26671
x-amz-meta-git_commit: 34df212
last-modified: Thu, 16 Nov 2023 21:29:58 GMT
server: AmazonS3
etag: "56f253d067322ed6ec468752a24f24d0"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: BecHXNWU94-jA00zTTp6FhXhMO-bG6d4BDuo_akuaHT5QkEriN2iKw==

GET
H2 200 iframebuster.js Show response
assets.bounceexchange.com/assets/bounce/ Frame 7E02 2 KB
1 KB 139ms
34ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/iframebuster.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 329c9c7026d1c9423b642686137df4cd4e720aecb0059ed286a5bb1b520b9fc9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:16:59 GMT
content-encoding: br
age: 2262134
x-guploader-uploadid: ABPtcPoaiD1cwx-9cva9k-e0fHIE3pL_Ya5Ch3EbJtlc8UM1HHFPwxzMHp-UxfNBJG9EBpktOmcsenqNYXVdqkje2Qz33g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 834
last-modified: Mon, 13 Nov 2023 15:33:19 GMT
server: UploadServer
etag: W/"e834a0cd12abffd04acda8e08953a77a"
vary: Accept-Encoding
x-goog-generation: 1699889599065515
x-goog-hash: crc32c=PdRfKg==, md5=6DSgzRKr/9BKzajgiVOneg==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 2317
accept-ranges: none
content-type: text/javascript; charset=UTF-8

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 7E02 202 KB
61 KB 75ms
72ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7c8f51219f79a7ffaaca9b739e91aedd1cd6816e3b7fa5b80cddf84ae17aade8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:32:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62114
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 13 Dec 2023 04:32:24 GMT

GET
H/1.1 200
OK moatad.js Show response
js.moatads.com/bangdfp107159576598/ Frame 7E02 0
423 B 269ms
89ms Script
application/x-javascript 104.117.182.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.182.58 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-117-182-58.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:13 GMT
Last-Modified: Mon, 14 May 2018 18:19:42 GMT
Server: AmazonS3
x-amz-request-id: KPQ702EH8B9R8HYH
ETag: "d41d8cd98f00b204e9800998ecf8427e"
Content-Type: application/x-javascript
Cache-Control: max-age=13841
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0
x-amz-id-2: Q0eV/VzTbQq8p6RNm0h7hOBrua1PX+SV9UwK3rsMPdO5hrR9YPbuH1C7gB1LYJC7ikH7SAUBtrA=

GET
H2 200 b-34df212-ae6f9fe2.js Show response
tagan.adlightning.com/mng-trib/ Frame 7497 68 KB
27 KB 84ms
84ms Script
application/javascript 3.161.213.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-54.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2a287439d841968fbb9edca3c80d9acc3b66897fd273a501ef8588461f8c1cd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 23:09:24 GMT
content-encoding: gzip
via: 1.1 82411d437ee2d2355a407b78473e6156.cloudfront.net (CloudFront)
x-amz-version-id: HDL2ZIRuJOCDdiq95fmqqTRa5yG_hp7B
x-amz-cf-pop: YUL62-P1
age: 1657790
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 26671
x-amz-meta-git_commit: 34df212
last-modified: Thu, 16 Nov 2023 21:29:58 GMT
server: AmazonS3
etag: "56f253d067322ed6ec468752a24f24d0"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: BfE3TXlHd5euNIHFl0zLk8Rwaebb3E36ozABkYfZd2AWofv9tkUMnA==

GET
H2 200 7445647657293544794
tpc.googlesyndication.com/simgad/ Frame 7497 55 KB
56 KB 259ms
91ms Image
image/gif 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7445647657293544794

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5e9786dbb44333b2779a147e019a4688139629814be3d8b10b0cd3014952d08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 05:01:42 GMT
x-content-type-options: nosniff
age: 81451
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56635
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 22:55:33 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 11 Dec 2024 05:01:42 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 7497 24 KB
9 KB 245ms
77ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 01:53:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6350
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 27 Dec 2023 01:53:23 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 7497 3 KB
2 KB 244ms
77ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 01:52:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6387
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 27 Dec 2023 01:52:46 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7497 0
0 101ms
100ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSQ0wff0Pd4l-lMUkq8StPolK_E3jQJvuLXkG5FsrIA117vrxnpduLoNANm7JVSW-5hYf_esCFoK80l_w9BcDfw7U2zhA
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 7497 202 KB
61 KB 75ms
74ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7c8f51219f79a7ffaaca9b739e91aedd1cd6816e3b7fa5b80cddf84ae17aade8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:32:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62114
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 13 Dec 2023 04:32:24 GMT

GET
H/1.1 200
OK moatad.js Show response
js.moatads.com/bangdfp107159576598/ Frame 7497 0
423 B 253ms
63ms Script
application/x-javascript 104.117.182.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.182.58 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-117-182-58.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:13 GMT
Last-Modified: Mon, 14 May 2018 18:19:42 GMT
Server: AmazonS3
x-amz-request-id: KPQ702EH8B9R8HYH
ETag: "d41d8cd98f00b204e9800998ecf8427e"
Content-Type: application/x-javascript
Cache-Control: max-age=13841
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0
x-amz-id-2: Q0eV/VzTbQq8p6RNm0h7hOBrua1PX+SV9UwK3rsMPdO5hrR9YPbuH1C7gB1LYJC7ikH7SAUBtrA=

GET
H2 200 b-34df212-ae6f9fe2.js Show response
tagan.adlightning.com/mng-trib/ Frame 8FD8 68 KB
27 KB 83ms
82ms Script
application/javascript 3.161.213.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-54.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2a287439d841968fbb9edca3c80d9acc3b66897fd273a501ef8588461f8c1cd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 23:09:24 GMT
content-encoding: gzip
via: 1.1 82411d437ee2d2355a407b78473e6156.cloudfront.net (CloudFront)
x-amz-version-id: HDL2ZIRuJOCDdiq95fmqqTRa5yG_hp7B
x-amz-cf-pop: YUL62-P1
age: 1657790
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 26671
x-amz-meta-git_commit: 34df212
last-modified: Thu, 16 Nov 2023 21:29:58 GMT
server: AmazonS3
etag: "56f253d067322ed6ec468752a24f24d0"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: MLatEwfiuqUZZSgTtD83-XQF238lUrPaibdUCj4ZBKJmkXO-j_wOKQ==

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 8FD8 202 KB
61 KB 73ms
73ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7c8f51219f79a7ffaaca9b739e91aedd1cd6816e3b7fa5b80cddf84ae17aade8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:32:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62114
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 13 Dec 2023 04:32:24 GMT

GET
H/1.1 200
OK moatad.js Show response
js.moatads.com/bangdfp107159576598/ Frame 8FD8 0
423 B 144ms
62ms Script
application/x-javascript 104.117.182.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.182.58 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-117-182-58.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:13 GMT
Last-Modified: Mon, 14 May 2018 18:19:42 GMT
Server: AmazonS3
x-amz-request-id: KPQ702EH8B9R8HYH
ETag: "d41d8cd98f00b204e9800998ecf8427e"
Content-Type: application/x-javascript
Cache-Control: max-age=13841
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0
x-amz-id-2: Q0eV/VzTbQq8p6RNm0h7hOBrua1PX+SV9UwK3rsMPdO5hrR9YPbuH1C7gB1LYJC7ikH7SAUBtrA=

GET
H2 200 b-34df212-ae6f9fe2.js Show response
tagan.adlightning.com/mng-trib/ Frame 0E73 68 KB
27 KB 87ms
87ms Script
application/javascript 3.161.213.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-54.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2a287439d841968fbb9edca3c80d9acc3b66897fd273a501ef8588461f8c1cd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 23:09:24 GMT
content-encoding: gzip
via: 1.1 82411d437ee2d2355a407b78473e6156.cloudfront.net (CloudFront)
x-amz-version-id: HDL2ZIRuJOCDdiq95fmqqTRa5yG_hp7B
x-amz-cf-pop: YUL62-P1
age: 1657790
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 26671
x-amz-meta-git_commit: 34df212
last-modified: Thu, 16 Nov 2023 21:29:58 GMT
server: AmazonS3
etag: "56f253d067322ed6ec468752a24f24d0"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 8Lk9zdz6f2_fM98ILiT-fzjmPqX-zZtcCrPnARiO22GwrxEJOBxI9Q==

GET
H2

200

bounce Show response
secure.adnxs.com/ Frame 0E73
Redirect Chain

https://secure.adnxs.com/ttj?id=28334192
https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D28334192

7 KB
4 KB

89ms
89ms

Script
application/javascript

68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D28334192

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Server

68.67.160.132 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

fcddf6a3df174e9a4b5a5421e61bf9a2580931433863cbef58ec5540445c0f4c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
content-encoding: gzip
an-x-request-uuid: b7a03983-93ae-4553-bcd3-11a07d8c619b
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
an-x-request-uuid: 6a8dd383-64ec-4b78-b1d2-10ee328a3055
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D28334192
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 0E73 202 KB
61 KB 78ms
77ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7c8f51219f79a7ffaaca9b739e91aedd1cd6816e3b7fa5b80cddf84ae17aade8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:32:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62114
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 13 Dec 2023 04:32:24 GMT

GET
H/1.1 200
OK moatad.js Show response
js.moatads.com/bangdfp107159576598/ Frame 0E73 0
423 B 137ms
64ms Script
application/x-javascript 104.117.182.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.182.58 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-117-182-58.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:13 GMT
Last-Modified: Mon, 14 May 2018 18:19:42 GMT
Server: AmazonS3
x-amz-request-id: KPQ702EH8B9R8HYH
ETag: "d41d8cd98f00b204e9800998ecf8427e"
Content-Type: application/x-javascript
Cache-Control: max-age=13841
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0
x-amz-id-2: Q0eV/VzTbQq8p6RNm0h7hOBrua1PX+SV9UwK3rsMPdO5hrR9YPbuH1C7gB1LYJC7ikH7SAUBtrA=

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 28FB
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E&gdpr=0
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3454403531523888000V10

43 B
479 B

79ms
63ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3454403531523888000V10

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 468TC9AFEP51EQXTS2YX
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:13 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3454403531523888000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Wed, 13 Dec 2023 03:39:13 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 28FB
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=53d2e5f28b

43 B
479 B

65ms
63ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=53d2e5f28b

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: M6K2TQSZXD9ZFA8K3X5H
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Wed, 13 Dec 2023 03:38:15 GMT
via: 1.1 ab1abc326c36ea4cd78ce117e4c20e88.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: YUL62-C2
age: 58
x-cache: Hit from cloudfront
location: https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=53d2e5f28b
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: HBtqBkCM3W2Pu13iWpuxS-vfO0lEXdu_ADvrbnD1Ux3Lr2MwrkGWoQ==

GET
H2 204 /
onetag-sys.com/match/ Frame 28FB 0
198 B 226ms
71ms Image
text/plain 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=113&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&gdpr=0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip187.ip-51-222-39.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 / Show response
geo.privacymanager.io/ 30 B
608 B 75ms
74ms Fetch
application/json 3.161.213.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: ats-wrapper.privacymanager.io
URL: https://ats-wrapper.privacymanager.io/ats-modules/fc9a1d14-9149-44a9-892e-d1e74cdea32a/ats.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-79.yul62.r.cloudfront.net
Software: /
Resource Hash: b94047a885ec91143818ebb76251e206a303a492429f67defc1c2e46c10c41c9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:30:53 GMT
via: 1.1 b052b62106bf04b3d8195399a6b77186.cloudfront.net (CloudFront), 1.1 4abd8708c8464a6586e6829348c23522.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD61-P2, YUL62-P1
age: 68900
x-amzn-requestid: 3d3a6857-82d4-4fd8-ae5c-a7daab6cf157
x-amzn-trace-id: Root=1-65781a3d-302de651124edc9e7102e3c6;Sampled=0;lineage=06620786:0
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-apigw-id: P0kJoFDHjoEEoCQ=
content-length: 30
x-amz-cf-id: 9KUMeILAjNTNj5Yt2exiKWv418RZq25FGhPmT7dAxg6iIk0sZDyIOw==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

GET
H2 200 4552eb791cd45ddc
pixel.sitescout.com/up/ Frame A201 43 B
417 B 67ms
64ms Image
image/gif 207.198.113.205
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sitescout.com/up/4552eb791cd45ddc?cntr_revenue=&cntr_transactionId=5552642173764&u1=&u2=&u3=&u4=&u5=&src=13619678&cat=retar0&type=retar0&cntr_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&gdpr=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 207.198.113.205 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://13619678.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:12 GMT
server: AC1.1
content-type: image/gif
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
cache-control: max-age=0,no-cache,no-store
content-length: 43
expires: Tue, 11 Oct 1977 12:34:56 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
54 B 55ms
52ms Ping
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-LMTT1ZNHB1&gtm=45je3bt0v9105985080z871194413&_p=1702438749746&gcs=G1--&gcd=11l1l1l1l5&dma=0&tcfd=10000&cid=1754874842.1702438751&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1702438751&sct=1&seg=0&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&dt=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&tfd=4590
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:13 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ee0fa599-c069-e3a6-ca5e-e764d074c321
pr-bh.ybp.yahoo.com/sync/openx/ Frame D1CF 43 B
602 B 82ms
55ms Image
image/gif 2600:1f18:4e9:5a02:d4c8:9f2:5a1a:543f
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/ee0fa599-c069-e3a6-ca5e-e764d074c321?gdpr=0

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:d4c8:9f2:5a1a:543f Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame D1CF 43 B
855 B 79ms
64ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=221ebfa0-4c6f-ca15-3b87-73064710c588

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: X2JD7F2ZCPCNNYV06WX3
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame D1CF
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=7ac8c3dd-50c5-71ef-fb89-f1912f230e68&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttd_puid=7ac8c3dd-50c5-71ef-fb89-f1912f230e68&gdpr=0&gdpr_consent=

43 B
314 B

96ms
61ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttd_puid=7ac8c3dd-50c5-71ef-fb89-f1912f230e68&gdpr=0&gdpr_consent=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttd_puid=7ac8c3dd-50c5-71ef-fb89-f1912f230e68&gdpr=0&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:13 GMT
server: Kestrel
content-length: 335

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame D1CF 170 B
409 B 329ms
95ms Image
image/png 172.217.13.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTZhNzEwMTctOTliMi0yZjRiLWVlNjktYWIyOGU1YzFjMDA4

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame D1CF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEChUJ_NKxOFZL_n2CT4uKP4&google_cver=1

43 B
97 B

66ms
64ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEChUJ_NKxOFZL_n2CT4uKP4&google_cver=1
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEChUJ_NKxOFZL_n2CT4uKP4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 bulk Show response
trc.taboola.com/medianewsgroup-mercurynews/log/3/ 0
277 B 123ms
108ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/medianewsgroup-mercurynews/log/3/bulk?tvi2=10408&tvi48=10143&tvi50=10882&route=US%3ACH%3AV&lti=deflated&bulkSize=12
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20231212-21-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-vcl-time-ms: 44
date: Wed, 13 Dec 2023 03:39:13 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 30001
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-mia-kmia1760053-MIA
pragma: no-cache
server: nginx
x-timer: S1702438754.767666,VS0,VE44
content-type: image/gif
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 413 B
184 B 348ms
348ms Fetch
text/plain 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2536280872594&correlator=1261919359116459&eid=31079783%2C31080056%2C44780990%2C676982961&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1-N-&iu_parts=8013%2Cmercurynews.com%2Cnews%2Cworld-news%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=6&didk=1340713370&sfv=1-0-40&eri=1&sc=1&cookie=ID%3Dfc6bc556d2a384d7%3AT%3D1702438752%3ART%3D1702438752%3AS%3DALNI_MZKv5x3DpCteuVOy_ahmFqEMo31Gg&gpic=UID%3D00000a03829fcb0a%3AT%3D1702438752%3ART%3D1702438752%3AS%3DALNI_MbNMer2ojuzcWXhxgyNldbNxv2m0w&abxe=1&dt=1702438753714&lmt=1702438753&adxs=-12245933&adys=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&vis=1&psz=0x0&msz=0x0&fws=1156&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsn3lVBLIA0gAvfqqLpcANisWGBv-6gxZCrTDLJwWTrYlOx2qDaiEwAP5S34yu1ssAUbWwiwbwLBQxluXtvg3IAHGw%2CAOrYGsm-EsVUlnc3mmFxUxSJ5Q4tAXhQyH6JVCD7lDhEn0wvHJ5REx0jjBCkWo5bFGs2MF3jHsqvvmA6mL5sLw%2CAOrYGsmjsboBWk7ZOYQfh9_6fgK44mnUrgaOzmkYqHaUNWDAX7UQBc17VN9o57YXIsJ_DJowKzi5HuwdKpJT3A%2CAOrYGsmZgTK3lgIbJ40NhCC2Qo1DM0yxSi9p2sBQMNwssbK5vCopZg3dtLBB1izzNd6N9JOScXiLmMgpniUvqwN830ca&ga_vid=1754874842.1702438751&ga_sid=1702438753&ga_hid=322855206&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRjpnYeKxjFIAFICCGQSWgoNY3J3ZGNudHJsLm5ldBJANzE2ZmQ4ZWZhZmU3OGMxZDMyODRmNDk3ZmJlN2E5ZmI5MjdhMmUxOTY0ZmZmMzJmNGI4NzNjYjMxZTlmYmM1ZhiPpYeKxjFIABLWAQoIcnRiaG91c2USwAEvTlhzaWhUWlNWdytISTNWelkvektQUFNNU2JmWVlUajBtb3NIamJkODVIOFByNzlSb0xkc05zRnNERWwrN3dDWG05Z1pQdFRObXRETW9RU2RTeTJ2MWZyWG1RN2QxOWtkOTVEVlZnL290SVAxZUE0SDROVVVQdDdhZTY5ZUQ2NmhXa0o2TktvekovdzdwMStNNExWYkI4UDY1cHRRUk5mRzJsRUI0MERzWEd4bmlNeU1FTXB2SUlaRWs4cWlSWHgYw6qHisYxSAASPgoFb3BlbngSLGV5SnBJam9pY1ZkVU9HaFFiRU5VYUdsb1dIcHNOVk4zVVRsc1VUMDlJbjA9GKSnh4rGMUgAEh0KDmVzcC5jcml0ZW8uY29tGOmdh4rGMUgAUgIIZA..&dlt=1702438749173&idt=2678&prev_scp=pos%3DSponsorship_1&cust_params=htlbidid%3D27454%26is_testing%3Dno%26kv%3Dworld-news%252Cnews%252Ccourts%252Cmidday-wire%252Cnation-world%252Crussia%252Cweird-news%252Capress%26page%3Darticle%26content%3D%26RPN%3D317317717277%26rurl%3D%26articleid%3D10256073%26blueconic%3Dnon-subs&adks=2471867576&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js?cb=31080056

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6be624d33bae5982abc06577561a08ad129bc2e9c0220006333e72705a16c844

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 154
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 OvaMediaPlayer.js Show response
vidstat.taboola.com/vpaid/vPlayer/player/v15.8.3/ 430 KB
81 KB 36ms
33ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v15.8.3/OvaMediaPlayer.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: a6b0c3370519efac53b92db289e5f6d5e8a2e30b73249eb74f8babf44aaa1b43

Request headers

Referer: https://www.mercurynews.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-meta-mtime: 1702288862
date: Wed, 13 Dec 2023 03:39:13 GMT
via: 1.1 varnish
content-encoding: br
x-amz-request-id: KDFNFS05F5YFV5Y8
age: 149815
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-meta-ctime: 1702288875
x-amz-meta-mode: 33188
content-length: 82549
x-amz-id-2: TwzhnItUPeV2NfS+m833nbsjixWAq7hGMKyVvycQxv+fOeRYys4X1jUM+bddpM3GY5fC2ZE091k=
x-served-by: cache-mia-kmia1760049-MIA
last-modified: Mon, 11 Dec 2023 10:01:16 GMT
server: AmazonS3-br
x-timer: S1702438754.824591,VS0,VE0
etag: "c358fb615e251d32afae5018bff88b7e"
x-amz-meta-uid: 0
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 73474

GET
H2 200 sync Show response
ch-match.taboola.com/ Frame 306F 658 B
743 B 107ms
62ms Document
text/html 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ch-match.taboola.com/sync?dast=V8Kq0CLAaweienCtrrEhNg9U5OFbTXJS4AAABgYMD_AEnZdrvBbLdxK4e73Vq08k3WEotz5BauFjPbZDNzmVwTIyAp2243mO02buVwt1uLVr7JWmJxjtzC1WJmm2xmLpNrYgUewTr93Q7Ty2SQtDx-g6TlMhsUFL_tZZCxXCY3QEPT6fC57vW63--udlk-rsvz7vJ97hq_2y8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nP5yAAAAAPDg____HwIAAABABAAAAAAJAAAAABQCKvxbELgAAAAAgOH___9fA8D4BgFnlgOCu3wH5d_y9QcAAAAAEAAAAAAkABBanksAvJxEn_j_________jzFAn3kj4______GQg-ABx8AD0IAAAAuhoSPHQrFGg0oEjlQKcIIAAAAgAmhndGRSTpBxaLK__9_vxWAKwAAAYxhQctbWXQHJd7CAAAAEIxZoIfF7zc77Bq_22X-_________838n_lHIzQyM5NGeBKeVM0vIADAml9AAAA26gYA4E0AnKBD0IrBYHUUYjecLXazxXAyOwAAAAB3_v____WA3GQ12thsK8NiM9vYXMuFxWRzrnyb2cg4mpkms-2RDEGn1HKprujjEazT3-0wvUwGScvjN0haLrNBQfHbXgYZy2WynwlbjFaTyWY5nC0Xk8FwNByN9mcgJoMBmojBcjmZLCa71Wg12gx3o9lggQRiMEEULRpMVqPRZDEZrkaT1Wy52O02iKJVq9loMxiuZpPZbrcaDobL0QhN2GK0mkw2y-FsuZgMhqPhaDREMGQaTAYLj3Gt8g2Ha9HKMXMrVyuTW-JYDBajjWE4GU3cotfH9PFNFh6TzYsEA872InlapBPhzOVy7pazmWPk3ExGs43FZhtZZoPNxDlzTjamiViiOVmkE9ll35usRhubbWVYbGYbm2u5sJhszpVvMxsZRzPTZLYvmQaTwcJjXKt8w-FatHLM3MrVyuSWOBaDxWhjGE5GE7fo9TF9fJOFx2TzN3aDyWgz3K0W-8ZuMBlthrvVYt-hM3xXn7NROlmKPT6vVjRNfmxOg8JlsHinRYu0dTj6jDqvbSJMrU07x8QqtEq8BoXn4FF9TSuJ1G99iLfrjfdgVMQSwUU6UbtMTofd5fv8LH_X4a12WT6uy_Pu8n0uYonSdJFO9JLBZLNXTPaKyV7y-nyeDrtb7bC7ZWany_OWWf5ut8hldzssX7fo7xY7jG_d03R0y_1u0dPjdZneestb8PB8Dn_L6SKWCE4X6UT0Mp4u6j9qmOFcsZnMFYvhXDdYJQAAAAAAAAAASzDJdBMAAAAAJ4PazAaL1TodzGA52AxXywVQoV6jCxgEAAAAAABglxR1LuLY-2ZSscYe02iXyemwu3yfn-XvOrzVLsvHdXneXb7PlQFUpP8w2-wzgljL2bIGAAAggA0AACCA2268CTiz4v7____HAQAAAJBDDwAAwH8f0BAzMzMzczO_ghgMh5P9A1Ah1nK2ut1Yy9kKKFC7CQQACKgH!&excid=22&docw=0&cijs=1&nlb=false
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: b3fc0dbcbc2d5d505162bb56477633ecfd5bbf12aa9bc7f065827fd34dfa2d49

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-type: text/html;charset=ISO-8859-1
date: Wed, 13 Dec 2023 03:39:13 GMT
machineid: 3801
server: nginx

GET
H2 200 sync Show response
ch-match.taboola.com/ Frame 3062 503 B
597 B 73ms
68ms Document
text/html 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ch-match.taboola.com/sync?dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&excid=22&docw=0&cijs=1&nlb=false
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: c8248c94b8869ed2cd9c60841e460de34487c4b414f578296f48f845f4615553

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-type: text/html;charset=ISO-8859-1
date: Wed, 13 Dec 2023 03:39:13 GMT
machineid: 3801
server: nginx

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame AB7A 3 KB
1 KB 222ms
52ms Document
text/html 3.219.246.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.219.246.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-246-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1929fcd13350a83cc79d5f08bf6f0f19b1e3cd45047117ddbab10e33a536bcbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Wed, 13 Dec 2023 03:39:14 GMT
etag: W/"072911342c4bae1c29fd6fa5b09167f13"
server: nginx
timing-allow-origin: *

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 3E58
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1

2 KB
1 KB

81ms
80ms

Document
text/html

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2311128a7adb647ab46350ca80ce577fa54e0c2a6d6d08c3044f5ea51b7796dd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 834b2dc4f8170a02-MIA
content-encoding: br
content-type: text/html
date: Wed, 13 Dec 2023 03:39:14 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mof355KreGRLKR64U6rDJPpntDU3MjRWGObhgZ%2Bh6Dca8QFmMtUPBq5luS6wYNFakXv8n12hbW5HsRZDwfn01Fj3RuAgAgV%2Fs2fpvUzA64qu79okmh2wwIEx79sRmEKLiBgXAGXtu1cBEA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 834b2dc478249ad2-MIA
content-length: 0
date: Wed, 13 Dec 2023 03:39:14 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n5iHO6xmYAnsdefyhPs%2B7ef4qyhWiL2C%2FWBgzsb09U9uL5c6%2BvaZFAuINOy%2F5UvrO7OhfISCiu4N9y7swi3SnqYlKmLxJpGZw88j%2BdnrOk1o%2BEhF%2BJNaBEJMN%2FsXDlO0U2PZ8YENkcz5CQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 sync-iframe Show response
cs-tam.minutemedia-prebid.com/ Frame E919 4 KB
5 KB 336ms
97ms Document
text/html 2600:9000:21a2:4400:17:c484:6380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21a2:4400:17:c484:6380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 1ac5f04ac629d807f6500d0a67b703ab261cdccad5812307ab18afb63028fd92

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: cs-tam.minutemedia-prebid.com
content-type: text/html
date: Wed, 13 Dec 2023 03:39:14 GMT
server: istio-envoy
via: 1.1 9f302ccf52b583f5eb46c01abcc2772e.cloudfront.net (CloudFront)
x-amz-cf-id: Cu1ppSSGRYN7UCj5EsHvHvr0htRsfKLqjPQ0o7gD5X8uBSyHry1nuA==
x-amz-cf-pop: YUL62-C1
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 4

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 6F8F
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=7364974048145578927&gdpr=0&gdpr_consent=

43 B
479 B

67ms
66ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=7364974048145578927&gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 2MBS6HAJS3SN6WT9Z4F0

Redirect headers

content-length: 0
date: Wed, 13 Dec 2023 03:39:13 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=7364974048145578927&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 1D40
Redirect Chain

https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0
https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=3a1e8229b78623d3&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&...
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAABzvHYGCT1TwM76g3gAAAAAAA&expiration=1702525154&is_secure=true&gdpr=0

43 B
479 B

64ms
62ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAABzvHYGCT1TwM76g3gAAAAAAA&expiration=1702525154&is_secure=true&gdpr=0

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: J1RJYC2XD5EQ0EVQ3J5H

Redirect headers

cache-control: no-cache, private, max-age=0, no-store
content-length: 0
date: Wed, 13 Dec 2023 03:39:14 GMT
expires: 0
location: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAABzvHYGCT1TwM76g3gAAAAAAA&expiration=1702525154&is_secure=true&gdpr=0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
pragma: no-cache
server: nginx

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 261D 15 KB
6 KB 71ms
66ms Document
text/html 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=&us_privacy=1-N-&gpp=DBACOe~CP2uYgAP2uYgAEXeBAENDeEwAP_gAEPgACiQGgwFQAFAANAAyABwAEAAJAAaAA9ACgAFsANAAhIBHAEeAKQAVoBAACDgKiAXmAxkBoIF5wCgAMgAcABAADQANAAhABHAEAAIOAvMAAAA~BP2uYgAP2uYgAEXeBAENDeCgAf_AAIfAAAaDAVAAUAA0ADIAHAAQAAkABoAD0AKAAWwA0ACEgEcAR4ApABWgEAAIOAqIBeYDGQGggXnAKAAyABwAEAANAA0ACEAEcAQAAg4C8w~1-N-&gpp_sid=6

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

16b1965919373fecd13455a5aeb9278934d63073fb07a1b5479c93a6eaf4889f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 13 Dec 2023 03:39:13 GMT
server: Kestrel
server-processing-duration-in-ticks: 1663806
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7E02 0
0 110ms
108ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsutSBsv1KVd0aprEU_hHMvKOaOt3t52naPCqt4YqrqEcNXfxUhn9D2sheWG1yrW-KagLF2wHbOjUE25a5DeCsFofbXZKlT61O7QULb7rBs7mwAhdG7Yu_QwPUFJjs_bdwdApM7QFRoi0_txRRinD_OJ0iKG8yypxzRqubBvW9YVa1B20w01VZT4D02adV9OUhZ_wcr4fE3T91sq5eDiYIHJb8DBwsUVrQMRe0YBbKUVkCZF_Oy5ZjGOl1NPLih3xrnrLqhHervg7xSFTPiTe9_2TEj0ps8lJj7oqSscbbkGAKekPhx0pQs3kHTa_afE4yHNpKj-AUGRwEyFYjfJeuz5WT-K_jAMDNi5uTpnpM8sm1H2hiZqguyOVBvbbZAGc2U&sai=AMfl-YSr20yaah4Ig3VJaOriNseV14s2GmzzOkjaXSO_b7x7Ix5nJ6w6ZYe7iJtneU7PGgkuX0LhzbL1eVBGHpr14Kk6pH-W746mHdkmSn_eZNloYQKpgTx_4nH0gFzd8TM&sig=Cg0ArKJSzL1su0BcPN2IEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7497 0
0 108ms
108ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvjyFTilc9QcDeIeXmH7JOETM-qPqhJM_-hk0Xa0BfmJzVYvt_4wc09DCgeI1I2tYgRgHuLwDr5NpcZySMakbrCIrxrxozFDVNn_SuEeso4etrU3hIXUhbwR9OGXx2G82pZe3kY5J2x0NeYlbIXgtlf2PAznbtUJXRAMuFMwPrZL3rwTR_yjLVFF-659a8hGUpP38cxgUC1SVSCfovQRUrunp6ybleQtqIl5F-9ryPtrutCtK2lASx4bzI5qijCrcld1Se-VB35XCRWqu78Ry9a_P0ejPczlvLt-kxAOHZRFwBVrTRkKoxo2441LtBvArC_Sr-WzuCNqsbhkyVNjViENuFZNnKMXdcYSa1AMW4OEAGzyaF4AiCECsbn336ViB4&sai=AMfl-YQwt4snT-WISFgUZ2_2xTh5B9hHYpTJeA0EiUewLUwRc3AguX2XMY7ZFAZ_DWNjoEsSTDUla9YSgGZ9dsk5NKYdJUWxvTBAswRa6XyI8Ob33jKed2l7IK1tkXd3mAc&sig=Cg0ArKJSzFPFfXmcSqK5EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7497 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 462812b49bc2256cfbf821137ce3fa0390e48cab24ab708a336295fa2df4aadd

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 206 blackScreen5.mp4
vidstatb.taboola.com/vid/ 89 KB
89 KB 38ms
35ms Media
video/mp4 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidstatb.taboola.com/vid/blackScreen5.mp4
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0407dafc112212a135d1aa4dd9b40ba0208c6bb6b1959f5535af093254189d66

Request headers

Referer: https://www.mercurynews.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Range: bytes=0-

Response headers

x-amz-meta-mtime: 1497790207
date: Wed, 13 Dec 2023 03:39:14 GMT
via: 1.1 8a771ca27e5a3c9e06b12b7af5d25aa4.cloudfront.net (CloudFront), 1.1 varnish
x-amz-cf-pop: MIA3-C3
age: 1351687
x-cache: Miss from cloudfront, HIT
Content-Range: bytes 0-90783/90784
x-amz-meta-mode: 33188
Content-Length: 90784
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Sun, 02 Jul 2017 20:40:57 GMT
server: AmazonS3
x-timer: S1702438754.232173,VS0,VE0
etag: "b2b087fe4ae638c533731c347fcd4df8"
x-amz-meta-uid: 0
access-control-allow-methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
content-type: video/mp4
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
access-control-allow-headers: *
x-amz-cf-id: 9EiAiFBVwZHmI3fGR78C7ATwwbmsDL1GB2xMpa136dVc18QTTk7V4g==
x-cache-hits: 298297

GET
H2

200

/
sync.taboola.com/sg/medianetrtb-network/1/rtb-h/ Frame 306F
Redirect Chain

https://cs.media.net/cksync?cs=69&type=tb&gdpr=0&us_privacy=1-N-&redirect=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fmedianetrtb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%3Cvsid%3E
https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10

0
372 B

70ms
67ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10
Requested by: Host: ch-match.taboola.com
URL: https://ch-match.taboola.com/sync?dast=V8Kq0CLAaweienCtrrEhNg9U5OFbTXJS4AAABgYMD_AEnZdrvBbLdxK4e73Vq08k3WEotz5BauFjPbZDNzmVwTIyAp2243mO02buVwt1uLVr7JWmJxjtzC1WJmm2xmLpNrYgUewTr93Q7Ty2SQtDx-g6TlMhsUFL_tZZCxXCY3QEPT6fC57vW63--udlk-rsvz7vJ97hq_2y8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nP5yAAAAAPDg____HwIAAABABAAAAAAJAAAAABQCKvxbELgAAAAAgOH___9fA8D4BgFnlgOCu3wH5d_y9QcAAAAAEAAAAAAkABBanksAvJxEn_j_________jzFAn3kj4______GQg-ABx8AD0IAAAAuhoSPHQrFGg0oEjlQKcIIAAAAgAmhndGRSTpBxaLK__9_vxWAKwAAAYxhQctbWXQHJd7CAAAAEIxZoIfF7zc77Bq_22X-_________838n_lHIzQyM5NGeBKeVM0vIADAml9AAAA26gYA4E0AnKBD0IrBYHUUYjecLXazxXAyOwAAAAB3_v____WA3GQ12thsK8NiM9vYXMuFxWRzrnyb2cg4mpkms-2RDEGn1HKprujjEazT3-0wvUwGScvjN0haLrNBQfHbXgYZy2WynwlbjFaTyWY5nC0Xk8FwNByN9mcgJoMBmojBcjmZLCa71Wg12gx3o9lggQRiMEEULRpMVqPRZDEZrkaT1Wy52O02iKJVq9loMxiuZpPZbrcaDobL0QhN2GK0mkw2y-FsuZgMhqPhaDREMGQaTAYLj3Gt8g2Ha9HKMXMrVyuTW-JYDBajjWE4GU3cotfH9PFNFh6TzYsEA872InlapBPhzOVy7pazmWPk3ExGs43FZhtZZoPNxDlzTjamiViiOVmkE9ll35usRhubbWVYbGYbm2u5sJhszpVvMxsZRzPTZLYvmQaTwcJjXKt8w-FatHLM3MrVyuSWOBaDxWhjGE5GE7fo9TF9fJOFx2TzN3aDyWgz3K0W-8ZuMBlthrvVYt-hM3xXn7NROlmKPT6vVjRNfmxOg8JlsHinRYu0dTj6jDqvbSJMrU07x8QqtEq8BoXn4FF9TSuJ1G99iLfrjfdgVMQSwUU6UbtMTofd5fv8LH_X4a12WT6uy_Pu8n0uYonSdJFO9JLBZLNXTPaKyV7y-nyeDrtb7bC7ZWany_OWWf5ut8hldzssX7fo7xY7jG_d03R0y_1u0dPjdZneestb8PB8Dn_L6SKWCE4X6UT0Mp4u6j9qmOFcsZnMFYvhXDdYJQAAAAAAAAAASzDJdBMAAAAAJ4PazAaL1TodzGA52AxXywVQoV6jCxgEAAAAAABglxR1LuLY-2ZSscYe02iXyemwu3yfn-XvOrzVLsvHdXneXb7PlQFUpP8w2-wzgljL2bIGAAAggA0AACCA2268CTiz4v7____HAQAAAJBDDwAAwH8f0BAzMzMzczO_ghgMh5P9A1Ah1nK2ut1Yy9kKKFC7CQQACKgH!&excid=22&docw=0&cijs=1&nlb=false
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ch-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 67736

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:14 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Location: https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Wed, 13 Dec 2023 03:39:14 GMT

GET
H2

200

/
sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/ Frame 306F
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/taboola/d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf?gdpr=0&us_privacy=1-N-
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A

0
372 B

70ms
68ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A
Requested by: Host: ch-match.taboola.com
URL: https://ch-match.taboola.com/sync?dast=V8Kq0CLAaweienCtrrEhNg9U5OFbTXJS4AAABgYMD_AEnZdrvBbLdxK4e73Vq08k3WEotz5BauFjPbZDNzmVwTIyAp2243mO02buVwt1uLVr7JWmJxjtzC1WJmm2xmLpNrYgUewTr93Q7Ty2SQtDx-g6TlMhsUFL_tZZCxXCY3QEPT6fC57vW63--udlk-rsvz7vJ97hq_2y8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nP5yAAAAAPDg____HwIAAABABAAAAAAJAAAAABQCKvxbELgAAAAAgOH___9fA8D4BgFnlgOCu3wH5d_y9QcAAAAAEAAAAAAkABBanksAvJxEn_j_________jzFAn3kj4______GQg-ABx8AD0IAAAAuhoSPHQrFGg0oEjlQKcIIAAAAgAmhndGRSTpBxaLK__9_vxWAKwAAAYxhQctbWXQHJd7CAAAAEIxZoIfF7zc77Bq_22X-_________838n_lHIzQyM5NGeBKeVM0vIADAml9AAAA26gYA4E0AnKBD0IrBYHUUYjecLXazxXAyOwAAAAB3_v____WA3GQ12thsK8NiM9vYXMuFxWRzrnyb2cg4mpkms-2RDEGn1HKprujjEazT3-0wvUwGScvjN0haLrNBQfHbXgYZy2WynwlbjFaTyWY5nC0Xk8FwNByN9mcgJoMBmojBcjmZLCa71Wg12gx3o9lggQRiMEEULRpMVqPRZDEZrkaT1Wy52O02iKJVq9loMxiuZpPZbrcaDobL0QhN2GK0mkw2y-FsuZgMhqPhaDREMGQaTAYLj3Gt8g2Ha9HKMXMrVyuTW-JYDBajjWE4GU3cotfH9PFNFh6TzYsEA872InlapBPhzOVy7pazmWPk3ExGs43FZhtZZoPNxDlzTjamiViiOVmkE9ll35usRhubbWVYbGYbm2u5sJhszpVvMxsZRzPTZLYvmQaTwcJjXKt8w-FatHLM3MrVyuSWOBaDxWhjGE5GE7fo9TF9fJOFx2TzN3aDyWgz3K0W-8ZuMBlthrvVYt-hM3xXn7NROlmKPT6vVjRNfmxOg8JlsHinRYu0dTj6jDqvbSJMrU07x8QqtEq8BoXn4FF9TSuJ1G99iLfrjfdgVMQSwUU6UbtMTofd5fv8LH_X4a12WT6uy_Pu8n0uYonSdJFO9JLBZLNXTPaKyV7y-nyeDrtb7bC7ZWany_OWWf5ut8hldzssX7fo7xY7jG_d03R0y_1u0dPjdZneestb8PB8Dn_L6SKWCE4X6UT0Mp4u6j9qmOFcsZnMFYvhXDdYJQAAAAAAAAAASzDJdBMAAAAAJ4PazAaL1TodzGA52AxXywVQoV6jCxgEAAAAAABglxR1LuLY-2ZSscYe02iXyemwu3yfn-XvOrzVLsvHdXneXb7PlQFUpP8w2-wzgljL2bIGAAAggA0AACCA2268CTiz4v7____HAQAAAJBDDwAAwH8f0BAzMzMzczO_ghgMh5P9A1Ah1nK2ut1Yy9kKKFC7CQQACKgH!&excid=22&docw=0&cijs=1&nlb=false
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ch-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 67736

Redirect headers

date: Wed, 13 Dec 2023 03:39:14 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A
content-length: 0

GET
H2 200 f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 254 B
748 B 36ms
34ms Image
image/png 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
date: Wed, 13 Dec 2023 03:39:14 GMT
via: 1.1 varnish
x-amz-request-id: KVAJ6Q009QCW97RM
age: 28351
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 254
x-amz-id-2: DwKR+V0ahyrIfE9ny0MhUhVxsDNtfz7Rh47R2/Ww+5VFFCIAWzGNhBCqKKGZpyPVnlKhUUHGAS0=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Wed, 24 Jun 2015 07:14:11 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer: S1702438754.242859,VS0,VE0
etag: "dfa7b52c86e56bd67fa4002f6ed19854"
content-type: image/png
abp: 76
access-control-allow-origin: *
cache-control: private,max-age=31536000
accept-ranges: bytes
x-cache-hits: 4744

GET
H2 200 usersync.html Show response
cdn.undertone.com/js/ Frame BDE5 12 KB
3 KB 248ms
74ms Document
text/html 2600:9000:215f:1c00:1f:2473:9080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:1c00:1f:2473:9080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0e4bc8f1a2c59e9e8e12e9f32a6812c46570925e9f72770d1475d8a1ee85476b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 77817
content-encoding: gzip
content-type: text/html
date: Wed, 13 Dec 2023 02:17:15 GMT
etag: W/"9f69f355a69e650f4a86354e76e60d40"
last-modified: Tue, 18 Jul 2023 10:31:18 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 612d3e065148a94cbbe94139733f662e.cloudfront.net (CloudFront)
x-amz-cf-id: vC07y7Ab7YXv72Oad-Y2tJtKkdgdDCODlQ7rse0fs-aqA84MMjw_kQ==
x-amz-cf-pop: YUL62-C2
x-amz-replication-status: COMPLETED
x-amz-server-side-encryption: AES256
x-amz-version-id: 5cDzvCPt5iTw_HTWM8q.kHMVnUk7Smec
x-cache: Hit from cloudfront

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame A58C 622 B
807 B 218ms
58ms Document
text/html 3.213.124.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.124.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-124-140.compute-1.amazonaws.com
Software: /
Resource Hash: 083e4ffbe1ee98b797c98a387c3889cd2aa4d676cd1cd2cfca12d58a6ce3980a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-length: 622
date: Wed, 13 Dec 2023 03:39:14 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 56D6 16 KB
6 KB 228ms
111ms Document
text/html 23.216.84.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.216.84.200 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-216-84-200.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=151605
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Wed, 13 Dec 2023 03:39:14 GMT
expires: Thu, 14 Dec 2023 21:45:59 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 tamptsync Show response
sync-amz.ads.yieldmo.com/ Frame F9AE 1 KB
1 KB 261ms
58ms Document
text/html 35.174.55.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.55.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-55-122.compute-1.amazonaws.com
Software: /
Resource Hash: bf0211dfa7a8bd5ba3fa598c774e45a34b57867dcc38bf530784454734b81821

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers: Cache-Control, Pragma, *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-encoding: gzip
content-type: text/html;charset=utf-8
date: Wed, 13 Dec 2023 03:39:14 GMT
pragma: no-cache
vary: accept-encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame FC10 281 B
555 B 221ms
80ms Document
text/html 23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 13 Dec 2023 03:39:14 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2

200

visitormatch Show response
bh.contextweb.com/ Frame B317
Redirect Chain

https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1

849 B
2 KB

65ms
65ms

Document
text/html

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

47cbe0dc5f3eaaf3d7bb29a4db51838afa833f5037b3f66c5526949d5ad9748f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-US
content-length: 849
content-type: text/html;charset=iso-8859-1
cw-server: bh-deployment-5c6449b65-h7vjf
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-US
cw-server: bh-deployment-5c6449b65-h7vjf
expires: -1
location: /visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

GET
H2 200 dinitsync Show response
crb.kargo.com/api/v1/ Frame AA8D 196 B
529 B 202ms
59ms Document
text/html 3.225.187.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://crb.kargo.com/api/v1/dinitsync?partners=A9
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.187.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-187-193.compute-1.amazonaws.com
Software: /
Resource Hash: 8842af1ca8ced91d4ff21df8d01723fa6d74b2b2101f2455fd19217d73a454c3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-encoding: gzip
content-length: 184
content-type: text/html; charset=UTF-8
date: Wed, 13 Dec 2023 03:39:14 GMT
expires: Thu, 01 Jan 1970 00:00:00 UTC
pragma: no-cache
vary: Origin
x-accel-expires: 0

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame B938
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0
https://s.amazon-adsystem.com/ecm3?id=2419896334597204579&ex=appnexus.com&gdpr=0

43 B
479 B

121ms
62ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=2419896334597204579&ex=appnexus.com&gdpr=0

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: ZS8WNJX7PQ1TFRMM2RXQ

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 6e89f409-f546-4113-87d1-3dfbbfef93db
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:14 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://s.amazon-adsystem.com/ecm3?id=2419896334597204579&ex=appnexus.com&gdpr=0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1

200
OK

amazon Show response
ce.lijit.com/beacon/ Frame 7754
Redirect Chain

https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0
https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0
https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1

1 KB
1 KB

71ms
70ms

Document
text/html

63.251.86.49
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.49 Beecher, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: ab2054673c2c1b89d8750c9d1c6f184c4599b4e63a3c647bef8dbe8c4731b5a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Encoding: gzip
Content-Length: 497
Content-Type: text/html
Date: Wed, 13 Dec 2023 03:39:14 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
Vary: Accept-Encoding, User-Agent
X-Sovrn-Pod: ad_ap1dca1

Redirect headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 0
Date: Wed, 13 Dec 2023 03:39:14 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Location: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap1dca1

GET
H2 200 sync-iframe Show response
cs-server-s2s.yellowblue.io/ Frame 9BE0 3 KB
3 KB 186ms
59ms Document
text/html 52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: a889b8f86e72bc950211dd2b701c0535027f8dcd95501debb5cb09b5f27d26d4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: cs-server-s2s.yellowblue.io
content-type: text/html
date: Wed, 13 Dec 2023 03:39:14 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame FE8F
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=228696289307885035225

43 B
479 B

115ms
71ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=228696289307885035225

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: DW4DQ5AYJY0B7K5TWZAH

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Wed, 13 Dec 2023 03:39:14 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=228696289307885035225
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 / Show response
geo.privacymanager.io/ 30 B
608 B 76ms
74ms Fetch
application/json 3.161.213.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: ats-wrapper.privacymanager.io
URL: https://ats-wrapper.privacymanager.io/ats-modules/fc9a1d14-9149-44a9-892e-d1e74cdea32a/ats.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-79.yul62.r.cloudfront.net
Software: /
Resource Hash: b94047a885ec91143818ebb76251e206a303a492429f67defc1c2e46c10c41c9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:30:53 GMT
via: 1.1 b052b62106bf04b3d8195399a6b77186.cloudfront.net (CloudFront), 1.1 4abd8708c8464a6586e6829348c23522.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD61-P2, YUL62-P1
age: 68901
x-amzn-requestid: 3d3a6857-82d4-4fd8-ae5c-a7daab6cf157
x-amzn-trace-id: Root=1-65781a3d-302de651124edc9e7102e3c6;Sampled=0;lineage=06620786:0
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-apigw-id: P0kJoFDHjoEEoCQ=
content-length: 30
x-amz-cf-id: fQ_3sOA06dlDkcfbRiVpqW3PQ3BnrjghNf9ol1xrqSyyN00vNShNzw==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8FD8 0
0 110ms
110ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstglqFAbe7S20GvYFcBP1L0rIXqTslEzUHUZH1fDrBO_fPFVF0DK5NRiyJ2OOFH3YNK4rMhKr2WVtthbgrJ1SA2dW-Jnx3kfXd8vHUv36QXa4_58bQ4Sb6OYCuk2nzXUo4g7tJGzl6yYH_F3SKtWGFd_hoEUztrKYtc6Hqsrs0jB6AQrVLzJ16C4i3yOlK-b5mT8hQinivvGYwdK1saJ29kvkb70CZbhmEC6lq3bWLehA-tEHZXb1U45eKUF3KxyiA6hgy7dNTmh7VDi0HBwOVK3pZqAHitFlL7kowZBWJv4Tc8EXAoFyRUulPsFacABymnVKh-2N9eDW3-lNtCjRia6Cb4mLZ0dbJTauTxQdTqeX4Soj0TRXillaZQR0uG0c6RZNw6aq3fX0CLvxoOnyNof6UIXc8WTW74&sai=AMfl-YR2kvapjr4o--RP3yqIkoX-h216nV1zTG3AneTkEv6MRstthwrQTGE8BSisqU4B7g14Ug7QBXwxXUDI_J2jaP5HA9H5m8MexvOX3EaZsZsiBks83XL1TDjCwXoKhIE&sig=Cg0ArKJSzD_knxs-N0SmEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 connatix.playspace.js Show response
cd.connatix.com/ Frame 591F 8 KB
4 KB 150ms
46ms Script
application/javascript 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cd.connatix.com/connatix.playspace.js
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50f888f04d694c5bdfe698161ad1d29ee2b45c4d5fb2762a5cc4ec622ba71467

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 834b2dc79f723349-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

GET
H2

200

/
sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/ Frame 3062
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/taboola/d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf?gdpr=0&us_privacy=1-N-
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A

0
372 B

76ms
65ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A
Requested by: Host: ch-match.taboola.com
URL: https://ch-match.taboola.com/sync?dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&excid=22&docw=0&cijs=1&nlb=false
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ch-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 67411

Redirect headers

date: Wed, 13 Dec 2023 03:39:14 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ORUKPgVE2oQIfh4pmnzHqHUPtCwmJ8f7cvvZTA--~A
content-length: 0

GET
H2

200

/
sync.taboola.com/sg/medianetrtb-network/1/rtb-h/ Frame 3062
Redirect Chain

https://cs.media.net/cksync?cs=69&type=tb&gdpr=0&us_privacy=1-N-&redirect=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fmedianetrtb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%3Cvsid%3E
https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10

0
372 B

70ms
67ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10
Requested by: Host: ch-match.taboola.com
URL: https://ch-match.taboola.com/sync?dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&excid=22&docw=0&cijs=1&nlb=false
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ch-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 67411

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:14 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Location: https://sync.taboola.com/sg/medianetrtb-network/1/rtb-h/?taboola_hm=3454403531523888000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Wed, 13 Dec 2023 03:39:14 GMT

GET
H2

200

rtb-h
sync-t1.taboola.com/sg/bidswitch-network/1/ Frame 3062
Redirect Chain

https://x.bidswitch.net/sync?gdpr=0&us_privacy=1-N-&ssp=taboola
https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&gdpr=0&consent=&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dtabo...
https://x.bidswitch.net/sync?dsp_id=354&user_id=927dc42219ef4d81b3b05a867d411d54&ssp=taboola&bsw_param=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=0&consent=&gdpr_pd=&expires=7
https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=

0
372 B

76ms
69ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ch-match.taboola.com
URL: https://ch-match.taboola.com/sync?dast=V8LXwCLAaweienCtrrEhNg9U5OFbTXJS4AAABgYID-AEkYFjbPZLJw6xYW11q0crncytFutJa5drvdcrIy7AarISAJw8LmmUwWbt3C4lqLVi6XWznajdYy1263W05Wht1gNQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPG6Ch6XT4XPd63e93V7ssH9fleXf5PneN3-2XDCabvWKyV0z2ktfn83TY3WqH3S0zO12et8zyd7tFLrvbYfm6RX-32GF8656mo1vud4ueHq_L9NZb3oKH53P4W05_OQAAAAB48P___w8BAAAAIAIAAACABAAAAAAKARX-LQhcAAAAAMDw____rwFgfIOAM8sBwV2-g_Jv-foDAAAAAAgAAAAAEgAILc8lAF5GMk_8_________8cYoM-8kfH___9_Y6EHwIMPgAchAAAAF0P4MA6gdqFHZ4kcsBRhBAAAAMCE0M7oyCSdoGJR5f__v98KwBUAgADGsKDlnCy6gxJvYQAAAAjGLNDD4vebHXaN3-0y__________9m_s_8oxEamZlJIzwJT6rmFxAAYM0vIAAAG3UDAPAmAE7QIWjFYLA6CrEbzha72WI4mR0AAACAO_____96QG6yGm1stpVhsZltbK7lwmKyOVe-zWxkHM1Mk9n2SIagU2q5VFf0CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYjIYoIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBEOmwWSw8BjXKt9wuBatHDO3crUyuSWOxWAx2hiGk9HELXp9TB_fZOEx2bxIMOBsL5KnRToRzlwu5245mzlGzs1kNNtYbLaRZTbYTJwz52RjmoglmpNFOpFd9r3JarSx2VaGxWa2sbmWC4vJ5lz5NrORcTQzTWb7kmkwGSw8xrXKNxyuRSvHzK1crUxuiWMxWIw2huFkNHGLXh_TxzdZeEw2f2M3mIw2w91qsW_sBpPRZrhbLfYdOsN39TkbpZOl2OPzakXT5MfmNChcBot3WrRIW4ejz6jz2ibC1Nq0c0ysQqvEa1B4Dh7V17SSSP3Wh3i73ngPRkUsEVykE7XL5HTYXb7Pz_J3Hd5ql-XjujzvLt_nIpYoTRfpRC8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nC5iieB0kU5EL-Ppov6jhhnOFZvJXLEYznWDVQIAAAAAAAAAsASTTDcBAAAAcDKozWywWK3TwQyGy81gtVwAFeo1un70eVFbDAZKdklR5yKOvW8mFWvsMY12mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XBlARfoPs80-I4i1nC1rAAAAAtgAAAACuO3Gm4AzK-7___9_HAAAAAA59AAAAOj3ATmp9cCNXivwK4jBcDjZPwAVYi1nq9uNtZytgAK1m0AAgIB6!&excid=22&docw=0&cijs=1&nlb=false
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ch-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 75449

Redirect headers

Location: //sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Date: Wed, 13 Dec 2023 03:39:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 0E73 0
0 109ms
109ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuDrQEmU5F_5Hp0OvCTn5Udh9-br5lEW3xnVJ116NnrPwpPl710jdoQ7eODuR5aw0---sYydDDzU5tDyKTCZl0RxPPl-40RCiSilbUrKotpvj39YskRGaDIKrSxHFWRQBgKMASMPwaYlptxCu3TcAaT94Eofh0RVjC-1ahS9jBBEv9nCgiyBWkDrkOZW-ivyY8HNr4GVAR-0mLIrBsSN1RT6vNhSykLSbt2LMHdV3OAxu113X9cWFURFxe9AljHs3oANZrJsVgghdDUckfME0NdtbIPBQJRH-Z4qU_aaNnn8wQ0FQWgH7TQwzsjn26oilQ_Hc3iQ35aZVfGyqcnPt0N0ktLMOLhSj4bIlWTLv7RnTLd-gFLzkMv2LYV4bARXcLqDk0&sai=AMfl-YTwBPKxwU8-q-h5mPKvVhrLBe9bEjqFomFuv_9w1YsWUs7OcaZKpbMR-foav24ftUD5rLu_1LdRt4Xv2cDNFneZDZcJ5j2uVAIdmyT1xzL7HE7jHDyjR-JX-RTMbHI&sig=Cg0ArKJSzIFPg8WK1o2REAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

rtb-h
sync.taboola.com/sg/supershiprtb-display-network/1/ Frame 27C5
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=taboola
https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZXknY8Co5sIAAFGhwMsAAAAA

0
372 B

71ms
70ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZXknY8Co5sIAAFGhwMsAAAAA
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 73332

Redirect headers

X-SO-Cluster-ID: 0
Date: Wed, 13 Dec 2023 03:39:15 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=taboola","cluster_id":0,"gdpr":false,"ipv4":"38.132.118.70","key":"ZXknY8Co5sIAAFGhwMsAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"a-ad40143"}
X-SO-Key: ZXknY8Co5sIAAFGhwMsAAAAA
Server: nginx
X-SO-Upstream-ID: a-ad40143
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZXknY8Co5sIAAFGhwMsAAAAA
Cache-Control: private
X-SO-HostName: a-ad40143.dc2p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 1
Content-Length: 0
X-SO-LB-Hostname: a-tgng40004.dc2p.scaleout.jp
X-SO-IP: 38.132.118.70

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 27C5 0
0 417ms
95ms Image
text/html 23.83.76.100
LEASEWEB-USA-LAX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=4
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.100 Los Angeles, United States, ASN395954 (LEASEWEB-USA-LAX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H2

200

/
sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/ Frame 27C5
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=16698
https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LQ382S7J-12-IUP9

0
372 B

71ms
70ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LQ382S7J-12-IUP9
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 77824

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LQ382S7J-12-IUP9
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
Expires: 0

GET
H2

200

/
sync.taboola.com/sg/baidurtb-network/1/rtb-h/ Frame 27C5
Redirect Chain

https://trace.mediago.io/ju/cs/taboola
https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=81fa84b78540ac2f2b4nhu00lq382u9k

0
372 B

70ms
67ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=81fa84b78540ac2f2b4nhu00lq382u9k
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 77824

Redirect headers

date: Wed, 13 Dec 2023 03:39:14 GMT
via: 1.1 google
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8
location: https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=81fa84b78540ac2f2b4nhu00lq382u9k
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

/
sync.taboola.com/sg/google-network/1/rtb-h/ Frame 27C5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
https://sync.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEGYjCQ04OBUNh_pQvHW866s&google_cver=1

0
372 B

68ms
67ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEGYjCQ04OBUNh_pQvHW866s&google_cver=1
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 67560

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEGYjCQ04OBUNh_pQvHW866s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 305
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 101956
jadserve.postrelease.com/dmp/ Frame 27C5 43 B
334 B 80ms
62ms Image
image/gif 52.72.239.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/dmp/101956?ntv_r=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fnativortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3DNTV_USER_ID
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.239.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-239-79.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 27C5 42 B
245 B 293ms
56ms Image
image/gif 8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf:$UID
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 12 Dec 2023 18:04:42 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 27C5
Redirect Chain

https://sync.taboola.com/sg/google-network/1/rtb/?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf

170 B
232 B

96ms
96ms

Image
image/png

172.217.13.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Server

172.217.13.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf
date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 67411

GET
H2

200

/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame 27C5
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c

0
407 B

69ms
68ms

Image
text/plain

151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-vcl-time-ms: 37
date: Wed, 13 Dec 2023 03:39:14 GMT
via: 1.1 varnish
x-served-by: cache-mia-kmia1760053-MIA
server: nginx
x-timer: S1702438755.557394,VS0,VE37
x-fastly-to-nlb-rtt: 35135
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-service-version: v1
x-cache-hits: 0

Redirect headers

location: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
date: Wed, 13 Dec 2023 03:39:14 GMT
server: Kestrel
content-length: 239

GET
H2 200 rtset
bh.contextweb.com/bh/ Frame 27C5 49 B
691 B 85ms
69ms Image
image/gif 198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=553204&ev=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5c6449b65-77f82
expires: -1

GET
H2

200

rtb-h
sync.taboola.com/sg/storygize-network/1/ Frame 27C5
Redirect Chain

https://sid.storygize.net/ccm/8a5f7a0b-b1ad-46dc-a085-63906ab7b98c
https://sid.storygize.net/csr?r=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstorygize-network%2F1%2Frtb-h%3Ftaboola_hm%3Db7fec9d5-4e28-46ab-824b-7b6257f7e002
https://sync.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=b7fec9d5-4e28-46ab-824b-7b6257f7e002

0
372 B

71ms
67ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=b7fec9d5-4e28-46ab-824b-7b6257f7e002
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 73332

Redirect headers

location: https://sync.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=b7fec9d5-4e28-46ab-824b-7b6257f7e002
date: Wed, 13 Dec 2023 03:39:14 GMT
content-length: 0

GET
H2

200

/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 27C5
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&gdpr=0&gdpr_consent=&us_privacy=1-N-&gpp=&gpp_sid=&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h...
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=4cf89b1e-3c16-4240-835a-8a2e9a220a72&gdpr=0&gdpr_consent=&us_privacy=1-N-

0
372 B

80ms
68ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=4cf89b1e-3c16-4240-835a-8a2e9a220a72&gdpr=0&gdpr_consent=&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 67560

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=4cf89b1e-3c16-4240-835a-8a2e9a220a72&gdpr=0&gdpr_consent=&us_privacy=1-N-
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1397578
content-length: 0
expires: Wed, 13 Dec 2023 00:00:00 GMT

GET
H2

200

/
sync.taboola.com/sg/id5-network/1/rtb-h/ Frame 27C5
Redirect Chain

https://id5-sync.com/s/464/9.gif?puid=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D...
https://id5-sync.com/c/464/464/7/1.gif?puid=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&gdpr=0&gdpr_consent=&us_privacy=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F6%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/464/441/6/2.gif?puid=u_f42259be-f060-4d3a-83c4-eb2194fe4518&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=42&3pid=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F1244%2F5%2F3.gif%3Fpuid%3D%5...
https://id5-sync.com/c/464/1244/5/3.gif?puid=Hz-bhPZH-3xZJd9nRju811w_&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F429%2F4%2F4.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/464/429/4/4.gif?puid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F434%2F3%2F5.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/464/434/3/5.gif?puid=d3a96dc9-f1df-41d5-a455-1cadd7e03e78&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?puid=AAAZ7E7K8k8AABRIfwE1Og&id5AccountNum=155&numCascadesAllowed=9
https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-3b4cgr8Rb8tdszZFsi8yQhDHLiT6636pwbi5yd_yeQ&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F464%2F124%2F1%2F7.gif%3Fpuid%3D...
https://ice.360yield.com/ul_cb/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-3b4cgr8Rb8tdszZFsi8yQhDHLiT6636pwbi5yd_yeQ&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F464%2F124%2F1%2F7.gif%3Fp...
https://id5-sync.com/cq/464/124/1/7.gif?puid=f0039fc3-5fbf-4300-a9a4-93611d91d788&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F796%2F0%2F8.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
https://id5-sync.com/c/464/796/0/8.gif?puid=4c48eca0-1acd-49bc-ab52-5fd54049c3ec&gdpr=0&gdpr_consent=
https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-3b4cgr8Rb8tdszZFsi8yQhDHLiT6636pwbi5yd_yeQ

0
372 B

69ms
68ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-3b4cgr8Rb8tdszZFsi8yQhDHLiT6636pwbi5yd_yeQ
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 70826

Redirect headers

location: https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-3b4cgr8Rb8tdszZFsi8yQhDHLiT6636pwbi5yd_yeQ
date: Wed, 13 Dec 2023 03:39:16 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

GET
H2

200

rtb-h
sync-t1.taboola.com/sg/bidswitch-network/1/ Frame 27C5
Redirect Chain

https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=&us_privacy=1-N-
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=taboola
https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=taboola
https://x.bidswitch.net/sync?dsp_id=70&user_id=3796756467315632505&ssp=taboola
https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

0
372 B

70ms
69ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 73332

Redirect headers

Location: //sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

rtb-h
match.taboola.com/sg/mediaforcebidder-network/1/ Frame 27C5
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=taboola
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola
https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f2c31c97-eee0-418e-8fae-cd8a32600f23
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f2c31c97-eee0-418e-8fae-cd8a32600f23&tbid=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&query=taboola_hm%3Df2c31c97-eee0-...

0
77 B

72ms
70ms

Image
text/plain

151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f2c31c97-eee0-418e-8fae-cd8a32600f23&tbid=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&query=taboola_hm%3Df2c31c97-eee0-418e-8fae-cd8a32600f23&isDirect=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 varnish
server: nginx
x-timer: S1702438755.139487,VS0,VE37
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-served-by: cache-mia-kmia1760053-MIA

Redirect headers

location: https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f2c31c97-eee0-418e-8fae-cd8a32600f23&tbid=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&query=taboola_hm%3Df2c31c97-eee0-418e-8fae-cd8a32600f23&isDirect=0
date: Wed, 13 Dec 2023 03:39:15 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 75449

GET
H2 200 xuid
eb2.3lift.com/ Frame 27C5 37 B
353 B 70ms
57ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7772&xuid=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&dongle=tbla&gdpr=0&gdpr_consent=&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif
date: Wed, 13 Dec 2023 03:39:14 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/ Frame 27C5
Redirect Chain

https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&ph=295bf259-a378-4089-aae8-a2a995ba8627&id=37f45540-fa88-4005-bf73-8a7ac39467e3&r=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fopenxrtb-network%2F1%2Fr...
https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=fdf220fe-bac4-40b8-8927-f0178e5eaadc

0
372 B

68ms
67ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=fdf220fe-bac4-40b8-8927-f0178e5eaadc
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 67560

Redirect headers

date: Wed, 13 Dec 2023 03:39:14 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=fdf220fe-bac4-40b8-8927-f0178e5eaadc
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 cds-pips.js Show response
cdn.taboola.com/scripts/ 3 KB
2 KB 41ms
29ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/cds-pips.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bce4b47b8fc12de49fac0a00e9039e38aa568aba0ee9154b93d20465f0289cfa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: uLMchp7BESXZGZqPSJ8.FcfKBYdWFxIf
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:14 GMT
x-amz-request-id: YM4DTV0379RTPDRG
age: 908
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 1347
x-amz-id-2: 1Z44jl0Vdmsn+djJTix2dCK9QJJhr+yDc72N/xLYl7mu+8pnM/H2XYxxNHcmgp8bnbw8v6vp79M=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Sun, 29 Oct 2023 14:06:32 GMT
server: AmazonS3
x-timer: S1702438754.490695,VS0,VE0
etag: "c52aa1ea682aef8ad5ebf7aff9662e35"
vary: Accept-Encoding
content-type: application/javascript
abp: 39
access-control-allow-origin: *
cache-control: private, max-age=3600
accept-ranges: bytes
x-cache-hits: 2652

GET
H2 200 eid.es5.js Show response
cdn.taboola.com/scripts/ 17 KB
7 KB 40ms
30ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/eid.es5.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: Bqo64Ai0BniIkPPSnUb8_cZLJGu.sClo
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:14 GMT
x-amz-request-id: AS6TTF5DRSZPKKPE
age: 14003
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 6467
x-amz-id-2: ZuPipVwogOT9XanztYjJDY+Vh2/HY8qDZkOe+1PXGoKP3zS7wSV+7M3PXS/WeABO4PzaNI7IZcI=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Sun, 02 Apr 2023 13:09:57 GMT
server: AmazonS3
x-tbl-debug: bestatus=200,beresp=OK
x-timer: S1702438754.490706,VS0,VE0
etag: "2fdf3e79d5e851201a0d52a886453d8b"
vary: Accept-Encoding
content-type: application/javascript
abp: 6
access-control-allow-origin: *
cache-control: private,max-age=14400
accept-ranges: bytes
x-cache-hits: 36783

GET
H2 200 fraud-detect.js Show response
cdn.taboola.com/scripts/ 121 B
367 B 39ms
30ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/fraud-detect.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 392c32f20b9f867852a946a6ed1c5e21476df9619083548b6585d80a3b5f9bd4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: vOXBAr_FxKHpU348.XTQhP6DWnVyKple
content-encoding: gzip
via: 1.1 varnish
date: Wed, 13 Dec 2023 03:39:14 GMT
x-amz-request-id: XKY2R4MY1MPFBWBY
age: 13437
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 125
x-amz-id-2: wVL5y3sSnV3I0ejly2N8ywYJTdnVvaGMyA/5MvuVp39q8Fk6dGUCj1xZxZuiJhwPQSzAhmE+TFo=
x-served-by: cache-mia-kmia1760053-MIA
last-modified: Thu, 15 Dec 2022 16:50:08 GMT
server: AmazonS3
x-timer: S1702438754.495106,VS0,VE0
etag: "f7a185d92ac2162dc0bc36c5d7ef7dfe"
vary: Accept-Encoding
content-type: application/javascript
abp: 97
access-control-allow-origin: *
cache-control: private,max-age=14400
accept-ranges: bytes
x-cache-hits: 30469

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 7AB0 170 B
232 B 102ms
97ms Image
image/png 172.217.13.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Amgkq_RBT0Od2CPr_2YE_mV5J14

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 17724
tags.bluekai.com/site/ Frame 7AB0 62 B
466 B 309ms
296ms Image
image/gif 23.43.252.214
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/17724?id=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.252.214 Newark, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-252-214.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Wed, 13 Dec 2023 03:39:14 GMT
content-length: 62
content-type: image/gif

GET
H2 200 Pug
image2.pubmatic.com/AdServer/ Frame 7AB0 42 B
493 B 298ms
67ms Image
image/gif 162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:14 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame 7AB0 43 B
61 B 67ms
65ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 setuid
ib.adnxs.com/ Frame 7AB0 43 B
867 B 106ms
103ms Image
image/gif 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=133&code=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a23-56-162-28.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.sitescout.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
an-x-request-uuid: 88444fa6-35e4-4bce-8688-a991727c58a2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 i.js Show response
tag.bounceexchange.com/3993/ 7 KB
3 KB 192ms
33ms Script
text/plain 34.120.253.250
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.bounceexchange.com/3993/i.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.253.250 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 250.253.120.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: 3c3293821cedd05e6ef92d9e9aef8e2ad70b95cfa050cebb079cc5ceca03b862

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:09:35 GMT
content-encoding: gzip
via: 1.1 google
age: 1779
x-envoy-upstream-service-time: 0
x-region: us-central1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2889
server: istio-envoy
etag: 651964e6bf6e2b
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=60
timing-allow-origin: *
link: <https://assets.bounceexchange.com>; rel=dns-prefetch, <https://events.bouncex.net>; rel=dns-prefetch, <https://data.cdnbasket.net>; rel=dns-prefetch, <https://page.cdnbasket.net>; rel=dns-prefetch, <https://view.cdnbasket.net>; rel=dns-prefetch, <https://ids.cdnwidget.com>; rel=dns-prefetch, <https://pix.cdnwidget.com>; rel=dns-prefetch, <https://api.bounceexchange.com>; rel=preconnect, <https://pd.cdnwidget.com>; rel=preconnect

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 60ms
57ms Image
image/gif 54.198.156.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTM2NjE0NzE3OCIsImVidXkiOiIyNjkyMzM4OTEzIiwiZWFkdiI6IjQ4Njg0NDkxNTUiLCJlY2lkIjoiMTM4MzExMTM1Mjc2IiwiZWVudiI6ImoiLCJlcGlkIjoiNTA2ODUyNTQiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Pacific%2FHonolulu&tzoff=600&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=191f45cc-25ef-4eb7-b827-dc38bb2fc4c0&pid=b95fdc8e-6db9-4524-86e6-2fed99ef0217&dtm=1702438754525&qnm=_matherq&visible=1&tabid=20d6cd17-3152-45e1-a085-1e4a77a1cb60&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&vp=1600x1200&ds=4000x7158&tofa=1702438751&vid=1&lvidt=1702438751&duid=efb485d2-e5b6-4b64-b1da-6f3c1f491b10&fp=1905609432&cid=ma23578&mrk=239876506
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.156.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-156-105.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Wed, 13 Dec 2023 03:39:14 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
DATA 200
OK truncated
/ Frame 7E02 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed903bc0a30a92f5c2e3fac75e66c4a4e6d75d5858514c3f6f9f84383b82a37e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7E02 0
0 250ms
105ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvy0XPJIZt7Ba2qjA00grI6b8Gr-ohJOmDgpuQgq8mFQWWnUIZ4S-_zMbrJ-eHByEvCkPMFGunJDdOKeZoK_aob_s6B7dQNnOWPupbJNYZdXZkw9ZENGuZu9vO1OuXahSf-st0AIsk8lRADgMGmljXCADQe6KYg5iHq-P2VZzvdfMtxBtpm95o_ljhogp8ys-eLP6A7F1ruRu68Y9CYfWM0svjWrz3toixLOCYmfT0O233fhNUCl-tr-ynvtN7-K3tmJOVIDruA3GxqYy2d9g0_cg7La3aYKbqm4f8WHmaMSOkVIgV2fMFnrLui78JYyuop2PEKH1kh99RwXUvyEY7Sz24FKZeAEY3cHdoDFu6Its0WJ0Jptm7P4r2JDYdmHSpwcQ&sai=AMfl-YTfbxvGVJWVN0ZmIRSs_ZsN-3ZvfKsZmdTr0JRCsB4PsMJFeeK6k3x2QTj9k0yzjWRzwD_Q_Kui5OOLrl_Dz_Ywt-E1ATnk9Fm1Pr_SDSCqXG1utHl74AeCOsNr3hU&sig=Cg0ArKJSzOIA1oWWP1MOEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 13 Dec 2023 03:39:14 GMT

GET
DATA 200
OK truncated
/ Frame 8FD8 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c7214a41fa83fc434398f53bd90c625c8f5481cc362dd3def9393f1c24a94463

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8FD8 0
0 210ms
107ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuVH99TN6LcQubT0g7E6HV6X3QWrSwJabW4xWTCIhTGzRKbbA-0-C0VEU8sQQqDO3-w12_qeT5UPQ07Nfo6zPFRb54o5S4737_7iRZikN0L_IlR6HzlxVW9ZNary9TSiK624ZxqSMPZZYUHgswi4_v_0FlLyqb7jqP8TmWdsMG64vbQ5L2q-3MI1bZ4ZcQGgJcxz7sqR3LG_CWjpo_dNttxqq38Pvhj87ZykVvP-0jNrQk-SqR2NJv_FG0bJohZ1saC303D8Y6b9UVwFydDhx40PftnBkyfyLXkr9B-Zd7VbQhkYxfXBGz9QQ27Krm7FbLrsTtyLbOxKfZufaMCNMT9y74SPmFAgG_7Po1hrk3-fz4qT3NwPf_AMBDaTVkayFOwYW5ipylck_ldTUWOA_sk_JER6DUTsw34xS8&sai=AMfl-YSh-vj6fLUbRhycof5O-8QVA9Qpu52L1oiTNfbAytlua8FpPkxB1LQ7VTDuEEqmH3miVBjugAY6RDQU4Ux4ZQbB9muJ-xZwF22bM3Ax94PuFYBXvp0Y6_XFLM_wOJI&sig=Cg0ArKJSzPwGdVgYi_w_EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 13 Dec 2023 03:39:14 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7497 0
0 183ms
106ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsszb7TEL3Y4JmJfGqj1zVlAuu-w1x27w5fsxmcLKbGlksHIFv1itR8f-HFj-Hv5jhqImkyGnzVmLSqKd8-1fLgAsX-f1Hg4BwEXHSDAWSfvjnDnQLPUNiYFldsvnchnik4jgkXfv1LmAV71uhAGnTqz6z0UrheYdByzuiP-Zc3Xe6v0ielvuCvregrXQ19mDkGSa5MEDvDy7Z1WXzC53692n0Q0XmnappjCmdvWdbzBdo2mcFbN0I6WNxI8kacFucpmtypRRbTnbZguwK5o8B4eTjQoSq7K8Mwnlf7AgCjUxulJASy-pjEMnubrmTeBVxDEjiXJrwYMiSVVdgujbeyF6D8Y-mPjTylhH14YvN3OfdCidhTXv3bB4oH7jJ1tHLn4mA&sai=AMfl-YTzktSuayRut4v9I7dM9QNW4plc5bEqKLv-a15OzLBIae0nlFOEokNqRGq-ED6dMhY_wzo-XHoZ4xvg8056WQgsMmZYBjqsvNtnepatGpHAiZOTnG53w-CoMmlCLWk&sig=Cg0ArKJSzOGqZhSGVylJEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 13 Dec 2023 03:39:14 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 3E58 43 B
855 B 68ms
67ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 5D04S8GF8DA6F9CSN0KQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

sync
x.bidswitch.net/ Frame 3E58
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZXknYtLdjQGqeEc7lLJVmwAA%262891&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://ib.adnxs.com/getuid?https://i.liadm.com/s/81081?bidder_id=91218&bidder_uuid=$UID&gdpr=0
https://i.liadm.com/s/81081?bidder_id=91218&bidder_uuid=2419896334597204579&gdpr=0
https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=2bec7ccf-fec8-4839-9b13-fc1f46482504&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D
https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=5a3f1a6b-829a-444b-9541-a9778d3d14bc
https://b1sync.zemanta.com/usersync/liveintent/?cb=//i.liadm.com/s/35004?bidder_id%3D98254%26bidder_uuid%3D__ZUID__
https://b1sync.zemanta.com/usersync/liveintent/?cb=%2F%2Fi.liadm.com%2Fs%2F35004%3Fbidder_id%3D98254%26bidder_uuid%3D__ZUID__&s=2
https://i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=xLZSBOnCQggXQSa3vxQK
https://mid.rkdms.com/bct?pid=bcccb40a-06d2-44fe-bdd2-a91ef4a5bfd0&&puid=2bec7ccf-fec8-4839-9b13-fc1f46482504&liid=&_ct=im
https://i.liadm.com/s/19948?bidder_id=178256&bidder_uuid=5059c06fe3544445b4c0d1680b9bf2d0
https://x.bidswitch.net/sync?dsp_id=42&user_id=

43 B
235 B

64ms
63ms

Image
image/gif

35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=42&user_id=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: HTTP/1.1
Server: 35.211.178.172 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/sync?dsp_id=42&user_id=
Date: Wed, 13 Dec 2023 03:39:15 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 6

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 3E58
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZXknYtLdjQGqeEc7lLJVmwAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOOJV_rWea0Fm9InagolRtw&google_cver=1

43 B
735 B

83ms
82ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOOJV_rWea0Fm9InagolRtw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pKXjcdkZeIU%2FNAal%2Bm%2BAvjJ%2FFigLTBQH5GPbe%2BkcTIqeM1Qekrv5CsWGd6mgWBgVKq0UFxwWFx1qsc8zgWtd0FyfJ3G1AU4X4qqn08Wf5G47iBi5B0yssRJ8ZDf0uYYxYtJk2VELjCxK1A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 834b2dcc4a790a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOOJV_rWea0Fm9InagolRtw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3E58
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&expiration=1705030755&gdpr=0&gdpr_consent=

43 B
740 B

79ms
78ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&expiration=1705030755&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nW%2BLX%2Bo4thEyt6qYI%2BWpoPnlfrD6iRrcVKm%2FHvKck4FO998btehKrvdgYpM9HBuutpwiSKI6xkpWXA7WGA%2Fz7vhVa%2Bxpkm4sN7Yqpri%2FfNDNLuwNPQFdH7N7vzm78dAzE%2F5E8c8OkqJ6cw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 834b2dcb99820a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&expiration=1705030755&gdpr=0&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:15 GMT
server: Kestrel
content-length: 323

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 3E58
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAAZ7E7K8k8AABRIfwE1Og&expiration=1703648355

43 B
740 B

110ms
109ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAAZ7E7K8k8AABRIfwE1Og&expiration=1703648355
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2F%2BFjT8q6NnO0edaol%2BwvTn7kjpuaed%2BUsfF3zsxmxLbWD11CbDoFZOWO%2FWXUb93NeQwOoWX8iLZn292yxOT%2FGMNCZ2diu2%2BYvrHPuU%2FWzwxfc25iMp2MdCHXJUXQqcdXkHiPWARH7DZag%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 834b2dcccb360a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAAZ7E7K8k8AABRIfwE1Og&expiration=1703648355
Date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 3E58
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=2079
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=970033170794683279

43 B
737 B

83ms
83ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=970033170794683279
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vLFBGibG%2FGjxv%2BJvakBZF06VxkqHUtrRsqxZJnHjVEKJQfUbaOx7lwLBlnZbZMLuW2kjb4VM0DhIPJQYquGhgI87lBo0zBU2Y78hPF6aGHmwasRPRFblDemkVJz%2FaJtXv9y5oi2evc%2Bo%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 834b2dcb99830a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=970033170794683279
Date: Wed, 13 Dec 2023 03:39:15 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3E58
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=68
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=-tBDgfwlV_hvwp42xPpc4iaEdkY

43 B
737 B

77ms
77ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=-tBDgfwlV_hvwp42xPpc4iaEdkY
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eJrDUP3d%2FiO0mcYNsFSMhHq3p2Eiplca1P9gZaMD8%2BJs%2BZePvglPipyTHVbwF5UeCKlvCnbCE2JcGEgA%2Bz1YKXBgfL2fjsy0ow0vzia5mLen1oDFaZpLrSJV%2FLrLuu%2B%2BNhVnNjYP6vXIkw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 834b2dcc4a7c0a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=-tBDgfwlV_hvwp42xPpc4iaEdkY
Date: Wed, 13 Dec 2023 03:39:15 GMT
Connection: keep-alive
Content-Length: 122
Content-Type: text/html; charset=utf-8

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 3E58
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2419896334597204579

43 B
731 B

80ms
78ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2419896334597204579
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iQoKLyAY9vZRRERQjBXw6ES02rMbPklFna1eSXPgMGz44G6tHOxqzQXGB5WrWo2gywf6RpFRy5PFPmULjPzdLTQnm1jxt472Aus1WTkov6sZVhMUrQfrYdUN7q9yHBYSMKmTNRXrXZsevg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 834b2dcb998a0a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
an-x-request-uuid: f2a54e78-de25-409c-8ef1-e33441dd9330
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2419896334597204579
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 3E58 43 B
479 B 65ms
64ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: WSN9STTT5G56AFRHQFAN
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame AB7A
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=2419896334597204579

35 B
250 B

278ms
61ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=2419896334597204579
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
an-x-request-uuid: 95b055e7-ee8a-4ff8-b555-9a251c8da7b4
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://usersync.gumgum.com/usersync?b=apn&i=2419896334597204579
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame AB7A
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_f42259be-f060-4d3a-83c4-eb2194fe4518&gdpr=0&gdpr_consent=&us_privacy=
https://ads.betweendigital.com/match?bidder_id=43092&gdpr=0&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dgumgum2%26expires%3D30%26u...
https://ads.betweendigital.com/match?bidder_id=43092&gdpr=0&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dgumgum2%26expires%3D30%26u...
https://x.bidswitch.net/sync?dsp_id=429&user_id=31df8acb-9287-535b-8298-504de7e1772e&ssp=gumgum2&expires=30&user_group=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=bsw&i=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=0&gdpr_consent=&us_privacy=

35 B
250 B

61ms
59ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=0&gdpr_consent=&us_privacy=
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame AB7A
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=8df567ad-78d0-49b9-9cf2-e17ce7730f2e

35 B
250 B

126ms
62ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=8df567ad-78d0-49b9-9cf2-e17ce7730f2e
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=8df567ad-78d0-49b9-9cf2-e17ce7730f2e
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame AB7A
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-fad04381-fc25-57f8-6fc2-9e36c4fa5ce2$ip$38.132.118.70

35 B
250 B

69ms
60ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-fad04381-fc25-57f8-6fc2-9e36c4fa5ce2$ip$38.132.118.70
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-fad04381-fc25-57f8-6fc2-9e36c4fa5ce2$ip$38.132.118.70
Date: Wed, 13 Dec 2023 03:39:15 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame AB7A
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-ppPZispE2pfzdzS6RBzl9PrE.IXKHHJcdPJU~A

35 B
250 B

163ms
58ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-ppPZispE2pfzdzS6RBzl9PrE.IXKHHJcdPJU~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-ppPZispE2pfzdzS6RBzl9PrE.IXKHHJcdPJU~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame AB7A
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync...
https://usersync.gumgum.com/usersync?b=vnt&i=4c48eca0-1acd-49bc-ab52-5fd54049c3ec

35 B
250 B

59ms
59ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=4c48eca0-1acd-49bc-ab52-5fd54049c3ec
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=4c48eca0-1acd-49bc-ab52-5fd54049c3ec
Date: Wed, 13 Dec 2023 03:39:15 GMT
Connection: keep-alive
X-CI-RTID: 19388114-09f4-4aca-af74-46a4746a0c45
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H2 200 142
match.deepintent.com/usersync/ Frame AB7A 0
339 B 270ms
58ms Image
image/gif 8.18.47.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.18.47.7 Miami, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif
date: Wed, 13 Dec 2023 03:39:14 GMT
server: b
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame AB7A
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_f42259be-f060-4d3a-83c4-eb2194fe4518&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://b1sync.zemanta.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=0&gdpr_consent=&puid=u_f42259be-f060-4d3a-83c4-eb2194fe4518&s=2&us_privacy=
https://usersync.gumgum.com/usersync?b=zem&i=ma1cNti43N9YBSlW5Yod&gdpr=0

35 B
250 B

60ms
60ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=ma1cNti43N9YBSlW5Yod&gdpr=0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&i=ma1cNti43N9YBSlW5Yod&gdpr=0
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 103
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame AB7A
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=RSLdR8HKiVWw&ev=1&pid=558355

35 B
250 B

175ms
58ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=RSLdR8HKiVWw&ev=1&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://usersync.gumgum.com/usersync?b=pln&i=RSLdR8HKiVWw&ev=1&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5c6449b65-77f82
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame AB7A
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=7364974048145578927

35 B
250 B

65ms
59ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=7364974048145578927
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=7364974048145578927
date: Wed, 13 Dec 2023 03:39:14 GMT
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame AB7A 43 B
479 B 99ms
69ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_f42259be-f060-4d3a-83c4-eb2194fe4518

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: R2EYD6NZ1GRVWZXNPC1V
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 68CC 281 B
555 B 72ms
72ms Document
text/html 23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=16698&endpoint=us-east&gdpr=0&us_privacy=1-N-
Requested by: Host: ch-match.taboola.com
URL: https://ch-match.taboola.com/sync?dast=V8Kq0CLAaweienCtrrEhNg9U5OFbTXJS4AAABgYMD_AEnZdrvBbLdxK4e73Vq08k3WEotz5BauFjPbZDNzmVwTIyAp2243mO02buVwt1uLVr7JWmJxjtzC1WJmm2xmLpNrYgUewTr93Q7Ty2SQtDx-g6TlMhsUFL_tZZCxXCY3QEPT6fC57vW63--udlk-rsvz7vJ97hq_2y8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nP5yAAAAAPDg____HwIAAABABAAAAAAJAAAAABQCKvxbELgAAAAAgOH___9fA8D4BgFnlgOCu3wH5d_y9QcAAAAAEAAAAAAkABBanksAvJxEn_j_________jzFAn3kj4______GQg-ABx8AD0IAAAAuhoSPHQrFGg0oEjlQKcIIAAAAgAmhndGRSTpBxaLK__9_vxWAKwAAAYxhQctbWXQHJd7CAAAAEIxZoIfF7zc77Bq_22X-_________838n_lHIzQyM5NGeBKeVM0vIADAml9AAAA26gYA4E0AnKBD0IrBYHUUYjecLXazxXAyOwAAAAB3_v____WA3GQ12thsK8NiM9vYXMuFxWRzrnyb2cg4mpkms-2RDEGn1HKprujjEazT3-0wvUwGScvjN0haLrNBQfHbXgYZy2WynwlbjFaTyWY5nC0Xk8FwNByN9mcgJoMBmojBcjmZLCa71Wg12gx3o9lggQRiMEEULRpMVqPRZDEZrkaT1Wy52O02iKJVq9loMxiuZpPZbrcaDobL0QhN2GK0mkw2y-FsuZgMhqPhaDREMGQaTAYLj3Gt8g2Ha9HKMXMrVyuTW-JYDBajjWE4GU3cotfH9PFNFh6TzYsEA872InlapBPhzOVy7pazmWPk3ExGs43FZhtZZoPNxDlzTjamiViiOVmkE9ll35usRhubbWVYbGYbm2u5sJhszpVvMxsZRzPTZLYvmQaTwcJjXKt8w-FatHLM3MrVyuSWOBaDxWhjGE5GE7fo9TF9fJOFx2TzN3aDyWgz3K0W-8ZuMBlthrvVYt-hM3xXn7NROlmKPT6vVjRNfmxOg8JlsHinRYu0dTj6jDqvbSJMrU07x8QqtEq8BoXn4FF9TSuJ1G99iLfrjfdgVMQSwUU6UbtMTofd5fv8LH_X4a12WT6uy_Pu8n0uYonSdJFO9JLBZLNXTPaKyV7y-nyeDrtb7bC7ZWany_OWWf5ut8hldzssX7fo7xY7jG_d03R0y_1u0dPjdZneestb8PB8Dn_L6SKWCE4X6UT0Mp4u6j9qmOFcsZnMFYvhXDdYJQAAAAAAAAAASzDJdBMAAAAAJ4PazAaL1TodzGA52AxXywVQoV6jCxgEAAAAAABglxR1LuLY-2ZSscYe02iXyemwu3yfn-XvOrzVLsvHdXneXb7PlQFUpP8w2-wzgljL2bIGAAAggA0AACCA2268CTiz4v7____HAQAAAJBDDwAAwH8f0BAzMzMzczO_ghgMh5P9A1Ah1nK2ut1Yy9kKKFC7CQQACKgH!&excid=22&docw=0&cijs=1&nlb=false
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://ch-match.taboola.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 13 Dec 2023 03:39:14 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21488%26id%3D%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21488%26id%3D%24UID&sovrn_retry=true
https://cs.minutemedia-prebid.com/cs?aid=21488&id=Hz-bhPZH-3xZJd9nRju811w_

0
331 B

105ms
58ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21488&id=Hz-bhPZH-3xZJd9nRju811w_
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Date: Wed, 13 Dec 2023 03:39:14 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cs.minutemedia-prebid.com/cs?aid=21488&id=Hz-bhPZH-3xZJd9nRju811w_
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://cs.admanmedia.com/sync/minute_media?gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21497%26puid%3D%5BUID%5D
https://cs.minutemedia-prebid.com/cs?aid=21497&puid=2d7cd741-b2ff-43a2-8b07-5d7aea112903

0
330 B

183ms
59ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21497&puid=2d7cd741-b2ff-43a2-8b07-5d7aea112903
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:14 GMT
Server: nginx
Location: https://cs.minutemedia-prebid.com/cs?aid=21497&puid=2d7cd741-b2ff-43a2-8b07-5d7aea112903
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://u.openx.net/w/1.0/cm?id=29975467-6f1b-4e06-b545-920b22ea49b2&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21477%26id%3D
https://cs.minutemedia-prebid.com/cs?aid=21477&id=e39121d9-2f57-4ebb-8311-e8666f20848d

0
330 B

59ms
58ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21477&id=e39121d9-2f57-4ebb-8311-e8666f20848d
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cs.minutemedia-prebid.com/cs?aid=21477&id=e39121d9-2f57-4ebb-8311-e8666f20848d
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://visitor.omnitagjs.com/visitor/bsync?uid=a1aca1d7a7acd80e26595e82223f1e6f&name=MinuteMedia&gdpr=0&gdpr_consent=&url=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21502%26id%3D%5BBUYER...
https://cs.minutemedia-prebid.com/cs?aid=21502&id=ae5cb4d92cac640c56214a027a9a24bc

0
330 B

59ms
58ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21502&id=ae5cb4d92cac640c56214a027a9a24bc
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
via: kong/2.8.4
x-content-type-options: nosniff
x-kong-proxy-latency: 0
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
location: https://cs.minutemedia-prebid.com/cs?aid=21502&id=ae5cb4d92cac640c56214a027a9a24bc
x-kong-upstream-latency: 3
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://ads.yieldmo.com/pbsync?is=mmed&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]&redirectUri=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21486%26uid%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21486&uid=3zZLSppjjLpvLOyWeM8o&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]

0
330 B

68ms
57ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21486&uid=3zZLSppjjLpvLOyWeM8o&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cs.minutemedia-prebid.com/cs?aid=21486&uid=3zZLSppjjLpvLOyWeM8o&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21495%26id%3D$UID&partner=minutemedia
https://cs.minutemedia-prebid.com/cs?aid=21495&id=ua-bdc1742c-16cb-3c9d-92f6-01f2de4b8468

0
330 B

64ms
55ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21495&id=ua-bdc1742c-16cb-3c9d-92f6-01f2de4b8468
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21495&id=ua-bdc1742c-16cb-3c9d-92f6-01f2de4b8468
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=562760&ev=1&us_privacy=[US_PRIVACY]&gdpr=0&gdpr_consent=&rurl=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21494%26id%3D%25%25VGUID%25%25
https://cs.minutemedia-prebid.com/cs?aid=21494&id=RSLdR8HKiVWw&ev=1&us_privacy=[US_PRIVACY]&pid=562760&gdpr_consent=&gdpr=0

0
330 B

59ms
58ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21494&id=RSLdR8HKiVWw&ev=1&us_privacy=[US_PRIVACY]&pid=562760&gdpr_consent=&gdpr=0
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://cs.minutemedia-prebid.com/cs?aid=21494&id=RSLdR8HKiVWw&ev=1&us_privacy=[US_PRIVACY]&pid=562760&gdpr_consent=&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5c6449b65-77f82
expires: -1

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=minutemedia
https://cs.minutemedia-prebid.com/cs?aid=21503&id=f2c31c97-eee0-418e-8fae-cd8a32600f23

0
330 B

59ms
58ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21503&id=f2c31c97-eee0-418e-8fae-cd8a32600f23
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: //cs.minutemedia-prebid.com/cs?aid=21503&id=f2c31c97-eee0-418e-8fae-cd8a32600f23
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21504%26uid%3D%5BUID%5D
https://cs.minutemedia-prebid.com/cs?aid=21504&uid=fe465988-48a7-435b-85d8-7a43b29d252e

0
330 B

64ms
56ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21504&uid=fe465988-48a7-435b-85d8-7a43b29d252e
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-146
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cs.minutemedia-prebid.com/cs?aid=21504&uid=fe465988-48a7-435b-85d8-7a43b29d252e
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://x.bidswitch.net/sync?ssp=minutemedia&gdpr=0&gdpr_consent=&user_id=%s
https://sync-dmp.mobtrakk.com/match/bidswitch?id=${user_id}&gdpr=0&consent=&usp=&ssp=minutemedia&bsw=5a3f1a6b-829a-444b-9541-a9778d3d14bc
https://sync-dmp.mobtrakk.com/match/bidswitch?id=%24%7Buser_id%7D&gdpr=0&consent=&usp=&ssp=minutemedia&bsw=5a3f1a6b-829a-444b-9541-a9778d3d14bc&chk=1
https://x.bidswitch.net/sync?dsp_id=457&user_id=MWIyYTViZTFhYTc5MjRlMQ&gdpr=0&gdpr_consent=&us_privacy=&ssp=minutemedia&bsw_param=5a3f1a6b-829a-444b-9541-a9778d3d14bc
https://cs.minutemedia-prebid.com/cs?aid=21490&id=5a3f1a6b-829a-444b-9541-a9778d3d14bc

0
330 B

62ms
59ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21490&id=5a3f1a6b-829a-444b-9541-a9778d3d14bc
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Location: //cs.minutemedia-prebid.com/cs?aid=21490&id=5a3f1a6b-829a-444b-9541-a9778d3d14bc
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=161683&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21482%26id%3D%23PMUID
https://cs.minutemedia-prebid.com/cs?aid=21482&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837

0
330 B

61ms
52ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21482&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21482&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
date: Wed, 13 Dec 2023 03:39:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 113
content-type: text/html; charset=utf-8

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=44808&gdpr=0&gdpr_consent=&callback_url=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21505%26id%3D$%7BUSER_ID%7D
https://ads.betweendigital.com/match?bidder_id=44808&gdpr=0&gdpr_consent=&callback_url=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21505%26id%3D%24%7BUSER_ID%7D&crf=1&rts=3809446494669699076
https://cs.minutemedia-prebid.com/cs?aid=21505&id=31df8acb-9287-535b-8298-504de7e1772e

0
330 B

58ms
57ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21505&id=31df8acb-9287-535b-8298-504de7e1772e
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21505&id=31df8acb-9287-535b-8298-504de7e1772e
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21480%26id%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21480&id=228696289307885035225

0
330 B

62ms
53ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21480&id=228696289307885035225
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21480&id=228696289307885035225
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame E919 0
72 B 309ms
69ms Image
text/plain 67.202.105.22
STEADFAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21485%26puid%3D33XUSERID33X
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.22 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip22.67-202-105.static.steadfastdns.net
Software: 33XP008 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-33x-status: 2000208
date: Wed, 13 Dec 2023 03:39:14 GMT
server: 33XP008

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sportority
https://sync.1rx.io/usersync2/rmpssp?sub=sportority&zcc=1&cb=1702438755442
https://ad.turn.com/r/cs?pid=45&rndcb=65167253
https://sync.1rx.io/usersync/turn/3840816935748909997?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005?redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21478%26id%3DRX-72d673f8-1f56-4be7-bc9e-8afa79a85...
https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005

0
330 B

58ms
58ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
date: Wed, 13 Dec 2023 03:39:16 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX72d673f81f564be7bc9e8afa79a8599a005
content-type: text/html

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3686&gdpr=0&gdpr_consent=
https://cs.minutemedia-prebid.com/cs?aid=21517&id=a571c37c266940a3e482ae33355490&gdpr_consent=&gdpr=0

0
330 B

60ms
59ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21517&id=a571c37c266940a3e482ae33355490&gdpr_consent=&gdpr=0
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cs.minutemedia-prebid.com/cs?aid=21517&id=a571c37c266940a3e482ae33355490&gdpr_consent=&gdpr=0
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1702438755427081-272

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=59&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]
https://cs.minutemedia-prebid.com/cs?aid=21498&id=7364974048145578927&gdpr=0&gdpr_consent=

0
330 B

73ms
61ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21498&id=7364974048145578927&gdpr=0&gdpr_consent=
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 6
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21498&id=7364974048145578927&gdpr=0&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:14 GMT
content-length: 0

GET

Pug
simage2.pubmatic.com/AdServer/ Frame E919
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&cb=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21492%26uid%3D
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79c-66a4-4783-bbae-f47394c1228d%26bidder%...
https://prebid.a-mo.net/cchain/0/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=appnexus&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...
https://id.a-mx.com/u?&gdpr=0&us_privacy=1---&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F1%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79c-66a4-4783-bbae-f...
https://prebid.a-mo.net/cchain/1/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=amx_com&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD...
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&us_privacy=1---&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%2...
https://prebid.a-mo.net/cchain/2/4518?us_privacy=1---&gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=index_rtb&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmVi...
https://cm.adform.net/cookie?&gdpr=0&us_privacy=1---&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F3%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79c...
https://prebid.a-mo.net/cchain/3/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=adform&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0...
https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&us_privacy=1---&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-m...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=6404b0f4ef780517&is_secure=true&networkId=17100&version=1&nuid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAABnY_eJfHo8QNWo9NNAAAAAAA&expiration=1702525157&nuid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=4c48eca0-1acd-49bc-ab52-5fd54049c3ec&gdpr=0&gdpr_consent=

0
0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=3r9HMldH&gdpr=0&gdpr_consent=
https://cs.minutemedia-prebid.com/cs?aid=21496&id=6708dfbe-c40c-4ab2-8984-61c0cd21b269&gdpr=0

0
330 B

61ms
53ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21496&id=6708dfbe-c40c-4ab2-8984-61c0cd21b269&gdpr=0
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21496&id=6708dfbe-c40c-4ab2-8984-61c0cd21b269&gdpr=0
date: Wed, 13 Dec 2023 03:39:15 GMT
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21484%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21484&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=2419896334597204579

0
330 B

61ms
58ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21484&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=2419896334597204579
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
an-x-request-uuid: 8f10ab6a-20a3-4240-b692-90159bc5665e
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cs.minutemedia-prebid.com/cs?aid=21484&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=2419896334597204579
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=196326&cb=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21476%26id%3D
https://cs.minutemedia-prebid.com/cs?aid=21476&id=ZXknYtLdjQGqeEc7lLJVmwAA%262891

0
330 B

58ms
57ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21476&id=ZXknYtLdjQGqeEc7lLJVmwAA%262891
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YnLHFU49JGM0c5G%2FGdzzcI4y2xu1jXKxlZvGjtLk%2F8M9tXEbtDWZ14z%2BdCEvVHm9xXch%2B2%2BcwsAMKAecmFVILhMIFugeoZ4qq1JKk7SvY%2BckMQJOdgAN6%2Ftko%2FUd4KJMMMuZFrAnKRg%2BVA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cs.minutemedia-prebid.com/cs?aid=21476&id=ZXknYtLdjQGqeEc7lLJVmwAA%262891
cache-control: no-cache
cf-ray: 834b2dcbfa160a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://csync.loopme.me/?pubid=11555&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&redirect=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21511%26id%3D%7Bdevice_id%7D
https://cs.minutemedia-prebid.com/cs?aid=21511&id=ca70ea33-40c7-4667-aa07-f2e195e840a8&gdpr_consent=[USER_CONSENT]&gdpr=[GDPR]

0
330 B

59ms
59ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21511&id=ca70ea33-40c7-4667-aa07-f2e195e840a8&gdpr_consent=[USER_CONSENT]&gdpr=[GDPR]
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21511&id=ca70ea33-40c7-4667-aa07-f2e195e840a8&gdpr_consent=[USER_CONSENT]&gdpr=[GDPR]
date: Wed, 13 Dec 2023 03:39:15 GMT
server: _
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame E919
Redirect Chain

https://b1sync.zemanta.com/usersync/minutemedia/?&cb=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21515%26uid%3D__ZUID__
https://cs.minutemedia-prebid.com/cs?aid=21515&uid=ma1cNti43N9YBSlW5Yod

0
330 B

64ms
62ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21515&uid=ma1cNti43N9YBSlW5Yod
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-tam.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Content-Type: text/html; charset=utf-8
Location: https://cs.minutemedia-prebid.com/cs?aid=21515&uid=ma1cNti43N9YBSlW5Yod
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 98
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame E919 43 B
479 B 66ms
63ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=minutemedia.com&id=qyyPx7czCp_mm

Requested by

Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-tam.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ETT93NBS87NW7AHGZK17
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
BLOB 200
OK 92f5058b-04da-40a4-8f3e-7aa4efc2294c
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/92f5058b-04da-40a4-8f3e-7aa4efc2294c
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 110ms
109ms Image
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_pgbrk&pvsid=2536280872594&vrg=202312060101&nw_id=8013&nslots=12&eid=31079783%2C31080056%2C44780990%2C676982961&pub_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&qid=CI_B7ci-i4MDFeumWgUdeX4OGw&iu=%2F8013%2Fmercurynews.com%2Fnews%2Fworld-news%2Fcube1_rrail_atf&e=1280&ofr=1037.515625&ret=300x250&req=300x250%7C300x600%7C300x1050%7C160x600&bm=0&efh=1&stk=0&ifi=6

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://ads.yieldmo.com/pbsync?is=rise&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11584%26uid%3D$UID
https://cs-server-s2s.yellowblue.io/cs?aid=11584&uid=3zZLSppjjLpvLOyWeM8o&gdpr=0&gdpr_consent=&us_privacy=

0
329 B

65ms
55ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11584&uid=3zZLSppjjLpvLOyWeM8o&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cs-server-s2s.yellowblue.io/cs?aid=11584&uid=3zZLSppjjLpvLOyWeM8o&gdpr=0&gdpr_consent=&us_privacy=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MUJCNzM1QUQtMzBFNy00QjM1LTgwNUYtRTdFRkIyRkRBODM3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837

0
329 B

58ms
57ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
date: Wed, 13 Dec 2023 03:39:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 115
content-type: text/html; charset=utf-8

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://csync.loopme.me/?pubid=11362&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11571%26id%3D%7Bdevice_id%7D
https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=21b57748-352b-4bec-9e64-5e220b5b3aaf&gdpr_consent=null&gdpr=0

0
329 B

65ms
61ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=21b57748-352b-4bec-9e64-5e220b5b3aaf&gdpr_consent=null&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=21b57748-352b-4bec-9e64-5e220b5b3aaf&gdpr_consent=null&gdpr=0
date: Wed, 13 Dec 2023 03:39:15 GMT
server: _
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 9BE0
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11587&uid=6708dfbe-c40c-4ab2-8984-61c0cd21b269&gdpr=0

0
329 B

87ms
58ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=6708dfbe-c40c-4ab2-8984-61c0cd21b269&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11587&uid=6708dfbe-c40c-4ab2-8984-61c0cd21b269&gdpr=0
date: Wed, 13 Dec 2023 03:39:15 GMT
content-length: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=5a3f1a6b-829a-444b-9541-a9778d3d14bc

0
329 B

60ms
58ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=5a3f1a6b-829a-444b-9541-a9778d3d14bc
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Location: https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=5a3f1a6b-829a-444b-9541-a9778d3d14bc
Date: Wed, 13 Dec 2023 03:39:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=562615&ev=1&us_privacy=[US_PRIVACY]&gdpr=0&gdpr_consent=&rurl=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11592%26uid%3D%25%25VGUID%25%25
https://cs-server-s2s.yellowblue.io/cs?aid=11592&uid=RSLdR8HKiVWw&ev=1&us_privacy=[US_PRIVACY]&pid=562615&gdpr_consent=&gdpr=0

0
329 B

59ms
57ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11592&uid=RSLdR8HKiVWw&ev=1&us_privacy=[US_PRIVACY]&pid=562615&gdpr_consent=&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://cs-server-s2s.yellowblue.io/cs?aid=11592&uid=RSLdR8HKiVWw&ev=1&us_privacy=[US_PRIVACY]&pid=562615&gdpr_consent=&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5c6449b65-77f82
expires: -1

GET
H2

200

cs
cs.yellowblue.io/ Frame 9BE0
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=77&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11600&id=7364974048145578927&gdpr=0&gdpr_consent=

0
329 B

59ms
58ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11600&id=7364974048145578927&gdpr=0&gdpr_consent=
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11600&id=7364974048145578927&gdpr=0&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:14 GMT
content-length: 0

GET
H2 200 cksync.php
contextual.media.net/ Frame 9BE0 57 B
454 B 1937ms
1762ms Image
image/gif 23.56.162.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=25&type=ris&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11585%26id%3D%3Cvsid%3E

Requested by

Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.28 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ed079d77ba54a8e4bfc931029de75b1f5128fcae45e274d53aca95f8ab17b438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Wed, 13 Dec 2023 03:39:17 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 57
x-mnet-hl2: E
expires: Wed, 13 Dec 2023 03:39:17 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D
https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=92c8df4b-872a-4caa-b0ce-ad030e8ada2b

0
329 B

58ms
57ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=92c8df4b-872a-4caa-b0ce-ad030e8ada2b
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=92c8df4b-872a-4caa-b0ce-ad030e8ada2b
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 9BE0
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11601&id=a571c37c266940a3e482ae33355490&gdpr_consent=&gdpr=0

0
329 B

58ms
57ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=a571c37c266940a3e482ae33355490&gdpr_consent=&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cs.yellowblue.io/cs?aid=11601&id=a571c37c266940a3e482ae33355490&gdpr_consent=&gdpr=0
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1702438755431059-169

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X
https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212376435591519

0
329 B

59ms
58ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212376435591519
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
referrer-policy: unsafe-url
server: 33XP012
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212376435591519
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D115667%26uid%3D%5BUID%5D
https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=d3a96dc9-f1df-41d5-a455-1cadd7e03e78

0
329 B

65ms
57ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=d3a96dc9-f1df-41d5-a455-1cadd7e03e78
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-6-152
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=d3a96dc9-f1df-41d5-a455-1cadd7e03e78
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11596%26id%3D$UID&gdpr=0&gdpr_consent=
https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=2419896334597204579&gdpr=0&gdpr_consent=

0
329 B

59ms
57ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=2419896334597204579&gdpr=0&gdpr_consent=
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
an-x-request-uuid: a2632296-0ea0-427b-975e-3ce1edc3dfc6
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=2419896334597204579&gdpr=0&gdpr_consent=
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame 9BE0
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11606%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$UID
https://cs-server-s2s.yellowblue.io/cs?aid=11606&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=2531413247159590299

0
329 B

58ms
57ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11606&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=2531413247159590299
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs-server-s2s.yellowblue.io/cs?aid=11606&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=2531413247159590299
date: Wed, 13 Dec 2023 03:39:15 GMT
server: nginx
content-length: 0
content-type: text/plain

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 9BE0
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=typeaholdings
https://sync.1rx.io/usersync2/rmpssp?sub=typeaholdings&zcc=1&cb=1702438755442
https://ad.turn.com/r/cs?pid=45&rndcb=3150766016
https://sync.1rx.io/usersync/turn/3840816935748909997?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005?redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21478%26id%3DRX-72d673f8-1f56-4be7-bc9e-8afa79a85...
https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005

0
329 B

59ms
59ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
date: Wed, 13 Dec 2023 03:39:16 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX72d673f81f564be7bc9e8afa79a8599a005
content-type: text/html

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 9BE0 43 B
479 B 78ms
69ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rise.com&id=DDkgENnzCj_s

Requested by

Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: C1P6CT62551PDGHT4QK4
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame AA8D 43 B
479 B 67ms
66ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=27352e2d-a23e-ca8d-6f97-151d526020c1&ex=kargo.com&gdpr=0&gdpr_consent=&us_privacy=

Requested by

Host: crb.kargo.com
URL: https://crb.kargo.com/api/v1/dinitsync?partners=A9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://crb.kargo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: JBHNWHEPH85PENXT6JDX
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame A58C 43 B
479 B 64ms
63ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=6708dfbe-c40c-4ab2-8984-61c0cd21b269

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 053NBNP6CZW5NP5EPWKV
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame A58C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=

68 B
279 B

61ms
59ms

Image
image/png

3.213.124.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 3.213.124.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-124-140.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:14 GMT
server: Kestrel
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame A58C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&gdpr=0&gdpr_consent=&google_hm=NjcwOGRmYmUtYzQwYy00YWIyLTg5ODQtNjFjMGNkMjFiMjY5
https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=

68 B
279 B

57ms
56ms

Image
image/png

3.213.124.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 3.213.124.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-124-140.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame A58C 0
73 B 362ms
68ms Image
text/plain 67.202.105.22
STEADFAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssc-cms.33across.com/ps/?ri=0013300001kQj2HAAS&ru=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DkzFyzzqXEqukMDumpVLB6Eq3%26source_user_id%3D33XUSERID33X
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.22 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip22.67-202-105.static.steadfastdns.net
Software: 33XP006 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-33x-status: 2000208
date: Wed, 13 Dec 2023 03:39:15 GMT
server: 33XP006

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame FC10 46 KB
13 KB 67ms
67ms Script
text/html 23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: f481eaba7b96578406b524f6c3e829ee2ad77d9614952c438d05eec9a62c697b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:14 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Dec 2023 16:41:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=46930
Connection: keep-alive
Content-Length: 13232
Expires: Wed, 13 Dec 2023 16:41:24 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 261D
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=mercurynews.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=8vKad3xKallOY3A3WEhUbTdpaGU4NWw4a0ZSbWl2dUxNUTNCYzVCU2pvaGtaS3krTDBUUDZzVHd4MTR2N3BpcUZyMGVqbXBNWWFoZGRha05BSHIvVWUvZlNEL1h4c0hGSWFlT2dod3YzSFE0TlpTeEIrSlNrN2E0Um4zeU...

425 B
655 B

415ms
53ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=8vKad3xKallOY3A3WEhUbTdpaGU4NWw4a0ZSbWl2dUxNUTNCYzVCU2pvaGtaS3krTDBUUDZzVHd4MTR2N3BpcUZyMGVqbXBNWWFoZGRha05BSHIvVWUvZlNEL1h4c0hGSWFlT2dod3YzSFE0TlpTeEIrSlNrN2E0Um4zeU5GKzR1QVZqRUh5NDhFY2VISHY1Nm1zelBkc3ByNWx0V2VwZnUzaDA1UFdTLytpN0ZsR051ZzhlTXRXRHdRNCtTUGdVVzhwNHlBMWxUem1zeEsrWlQ0RHJ0OE03UTRIZ3daTVpSN2lRcTBlTG5JTjgrZGhjenY0L0tNZ0xhUzV5ZW9QNys3TlpBU2N1aERWU0JaclNPR25LL1BmN3FaYXJMU3UyT0NoaHVWWHIzMmVSYjY3Yz18&cppv=2

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fa14e99ff0b29910a42854e8df78dd47eaa1d252c794500848ccb52ebe27a8cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 702516
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=8vKad3xKallOY3A3WEhUbTdpaGU4NWw4a0ZSbWl2dUxNUTNCYzVCU2pvaGtaS3krTDBUUDZzVHd4MTR2N3BpcUZyMGVqbXBNWWFoZGRha05BSHIvVWUvZlNEL1h4c0hGSWFlT2dod3YzSFE0TlpTeEIrSlNrN2E0Um4zeU5GKzR1QVZqRUh5NDhFY2VISHY1Nm1zelBkc3ByNWx0V2VwZnUzaDA1UFdTLytpN0ZsR051ZzhlTXRXRHdRNCtTUGdVVzhwNHlBMWxUem1zeEsrWlQ0RHJ0OE03UTRIZ3daTVpSN2lRcTBlTG5JTjgrZGhjenY0L0tNZ0xhUzV5ZW9QNys3TlpBU2N1aERWU0JaclNPR25LL1BmN3FaYXJMU3UyT0NoaHVWWHIzMmVSYjY3Yz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 263816
content-length: 0
expires: 0

GET
H2 200 sync Show response
gum.criteo.com/ Frame 0E73 78 B
318 B 58ms
58ms Script
text/javascript 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f2a07716b5193ec7499e6a03e6e354858d11f5e8e701bd8bcc25535314c22e55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:14 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 809099
expires: 60

GET
H2 200 ttj Show response
secure.adnxs.com/ Frame 0E73 0
646 B 69ms
69ms Script
text/html 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1702438754&bdh=8SYitYuaG9HKEOA6jm7Nh642C5o.&&bdref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F,https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&&id=28334192

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
an-x-request-uuid: 59285070-5879-4eb3-93ae-a1581faeda98
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 29D2
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1301&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=adf&i=2531413247159590299&gdpr=0&gdpr_consent=

35 B
208 B

63ms
63ms

Document
image/gif

3.219.246.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=adf&i=2531413247159590299&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.219.246.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-246-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif;charset=UTF-8
date: Wed, 13 Dec 2023 03:39:15 GMT
expires: 0
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Wed, 13 Dec 2023 03:39:15 GMT
expires: -1
location: https://rtb.gumgum.com/usersync?b=adf&i=2531413247159590299&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 815F 170 B
188 B 105ms
96ms Document
image/png 172.217.13.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9mNDIyNTliZS1mMDYwLTRkM2EtODNjNC1lYjIxOTRmZTQ1MTg=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Wed, 13 Dec 2023 03:39:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 3900 16 KB
6 KB 70ms
59ms Document
text/html 23.216.84.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.216.84.200 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-216-84-200.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=151604
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Wed, 13 Dec 2023 03:39:15 GMT
expires: Thu, 14 Dec 2023 21:45:59 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 56A1
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c

35 B
250 B

90ms
61ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:15 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 193
date: Wed, 13 Dec 2023 03:39:15 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
server: Kestrel

GET idsync
tg.socdm.com/aux/ Frame AB97 0
0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 0942
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=-4J8_a84CG5WutC2Rd4REGzjqoVrUGIkZ5efxx__39w&pi=gumgum&tc=1

35 B
250 B

60ms
60ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=-4J8_a84CG5WutC2Rd4REGzjqoVrUGIkZ5efxx__39w&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:15 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Wed, 13 Dec 2023 03:39:15 GMT Wed, 13 Dec 2023 03:39:15 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=-4J8_a84CG5WutC2Rd4REGzjqoVrUGIkZ5efxx__39w&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame B6BA
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
555 B

95ms
94ms

Document
text/html

23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 13 Dec 2023 03:39:15 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 13 Dec 2023 03:39:15 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2 200 vast2 Show response
tag.targeting.unrulymedia.com/rmp/247367/0/ 168 B
365 B 367ms
63ms XHR
application/xml 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.targeting.unrulymedia.com/rmp/247367/0/vast2?adtype=video&compMode=and&dim=101&vastfw=vpaid&z=1r&url=www.mercurynews.com&w=955&h=537&us_privacy=1-N-&schain=1.0,1!taboola.com,1436213,1,150443120
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v15.8.3/OvaMediaPlayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: d9aa13a53642c4a5c2939af8359106dbceb85bd44dcaff668ab3518a77056293

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 168
content-type: application/xml

GET
H2 200 av Show response
taboola-d.openx.net/v/1.0/ 48 B
310 B 337ms
297ms XHR
text/xml 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://taboola-d.openx.net/v/1.0/av?auid=541033705&gdpr=0&us_privacy=1-N-
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v15.8.3/OvaMediaPlayer.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: a355f2718a8d0b7444670aca6fd1dfdc126f9b8e9931a34a52cac9c343a68e3f

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept-Encoding
content-type: text/xml
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.mercurynews.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 vast2 Show response
tag.targeting.unrulymedia.com/rmp/217713/0/ 168 B
366 B 359ms
60ms XHR
application/xml 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.targeting.unrulymedia.com/rmp/217713/0/vast2?adtype=video&compMode=and&dim=101&vastfw=vpaid&z=1r&url=www.mercurynews.com&w=955&h=537&us_privacy=1-N-&schain=1.0,1!taboola.com,1436213,1,150443120
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v15.8.3/OvaMediaPlayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: d9aa13a53642c4a5c2939af8359106dbceb85bd44dcaff668ab3518a77056293

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 168
content-type: application/xml

GET
H2 200 vast2 Show response
tag.targeting.unrulymedia.com/rmp/247367/0/ 168 B
365 B 326ms
72ms XHR
application/xml 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.targeting.unrulymedia.com/rmp/247367/0/vast2?adtype=video&compMode=and&dim=101&vastfw=vpaid&z=1r&url=www.mercurynews.com&w=700&h=393&us_privacy=1-N-&schain=1.0,1!taboola.com,1436213,1,-116728777
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v15.8.3/OvaMediaPlayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: d9aa13a53642c4a5c2939af8359106dbceb85bd44dcaff668ab3518a77056293

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 168
content-type: application/xml

GET
H2 200 av Show response
taboola-d.openx.net/v/1.0/ 48 B
240 B 294ms
293ms XHR
text/xml 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://taboola-d.openx.net/v/1.0/av?auid=541033705&gdpr=0&us_privacy=1-N-
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v15.8.3/OvaMediaPlayer.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: a355f2718a8d0b7444670aca6fd1dfdc126f9b8e9931a34a52cac9c343a68e3f

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept-Encoding
content-type: text/xml
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.mercurynews.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 vast2 Show response
tag.targeting.unrulymedia.com/rmp/217713/0/ 168 B
365 B 308ms
60ms XHR
application/xml 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.targeting.unrulymedia.com/rmp/217713/0/vast2?adtype=video&compMode=and&dim=101&vastfw=vpaid&z=1r&url=www.mercurynews.com&w=700&h=393&us_privacy=1-N-&schain=1.0,1!taboola.com,1436213,1,-116728777
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v15.8.3/OvaMediaPlayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: d9aa13a53642c4a5c2939af8359106dbceb85bd44dcaff668ab3518a77056293

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-type: text/plain

Response headers

access-control-allow-origin: https://www.mercurynews.com
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 168
content-type: application/xml

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 9C81 2 KB
863 B 74ms
69ms Document
text/html 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=765b4e6bb9c8438

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip187.ip-51-222-39.net

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://cs-tam.minutemedia-prebid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=minute_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east

281 B
555 B

78ms
78ms

Document
text/html

23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://cs-tam.minutemedia-prebid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 13 Dec 2023 03:39:15 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 13 Dec 2023 03:39:15 GMT
location: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
server: AkamaiGHost

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame F9AE 43 B
479 B 65ms
64ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=3zZLSppjjLpvLOyWeM8o&gdpr=0

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QQ930CCZY4DDHTPC2M3M
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame F9AE
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3107&partner_device_id=3zZLSppjjLpvLOyWeM8o
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=f2ab11c6-9b76-4f61-9ae1-0e1fe25e4115%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttd_puid=f2ab11c6-9b76-4f61-9ae1-0e1fe25e4115%2C%2C

95 B
124 B

61ms
61ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttd_puid=f2ab11c6-9b76-4f61-9ae1-0e1fe25e4115%2C%2C

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttd_puid=f2ab11c6-9b76-4f61-9ae1-0e1fe25e4115%2C%2C
date: Wed, 13 Dec 2023 03:39:15 GMT
server: Kestrel
content-length: 359

GET
H2

200

RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
sync.targeting.unrulymedia.com/csync/ Frame F9AE
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&redir%3Dhttps%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&zcc=1&cb=1702438755442
https://ad.turn.com/r/cs?pid=45&rndcb=2072608983
https://sync.1rx.io/usersync/turn/3840816935748909997?dspret=1&gdpr=0&gdpr_consent=&us_privacy=1-N-
https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005

43 B
377 B

72ms
67ms

Image
image/gif

69.194.240.13
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 69.194.240.13 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-length: 43
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location: https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
cache-control: no-store, no-cache, must-revalidate
expires: 0
content-type: text/html

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame F9AE
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=3zZLSppjjLpvLOyWeM8o
https://ads.yieldmo.com/v000/sync?tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c

43 B
610 B

70ms
57ms

Image
image/gif

52.0.227.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 52.0.227.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-227-33.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

location: https://ads.yieldmo.com/v000/sync?tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
date: Wed, 13 Dec 2023 03:39:15 GMT
server: Kestrel
content-length: 181

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame F9AE 170 B
188 B 98ms
96ms Image
image/png 172.217.13.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_hm=M3paTFNwcGpqTHB2TE95V2VNOG8=

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-34-234-28-111.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync
sync-pm.ads.yieldmo.com/ Frame F9AE
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
https://image4.pubmatic.com/AdServer/SPug?p=160648&pmc=1&pr=https%3A%2F%2Fsync-pm.ads.yieldmo.com%2Fsync%3Fpn_id%3Dpub%26id%3D1BB735AD-30E7-4B35-805F-E7EFB2FDA837%26gdpr%3D-1%26gdpr_consent%3D
https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=-1&gdpr_consent=

43 B
615 B

114ms
58ms

Image
image/gif

35.174.55.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=-1&gdpr_consent=
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 35.174.55.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-55-122.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

location: https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=-1&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame B317
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=emdocFlXRG9IbVRJMFlkMFBxQXNhQQ&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDE1aTGSAQsTI_VYdbsWCFo&google_cver=1

49 B
828 B

67ms
67ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDE1aTGSAQsTI_VYdbsWCFo&google_cver=1

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5c6449b65-77f82
expires: -1

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDE1aTGSAQsTI_VYdbsWCFo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 335
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame B317
Redirect Chain

https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid=&gdpr=0&gdpr_consent=
https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=686cc4dc3ef623d3&is_secure=true&networkId=14200&version=1&nuid=&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMujhGhbghUQMOaiotAAAAAAA&expiration=1702525155&nuid=&is_secure=true&gdpr_consent=&gdpr=0

49 B
856 B

65ms
65ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMujhGhbghUQMOaiotAAAAAAA&expiration=1702525155&nuid=&is_secure=true&gdpr_consent=&gdpr=0

Requested by

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5c6449b65-77f82
expires: -1

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMujhGhbghUQMOaiotAAAAAAA&expiration=1702525155&nuid=&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame B317 43 B
479 B 65ms
64ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=RSLdR8HKiVWw&ex=Pulsepoint

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 4CQ6M6MZXTPG6CWAVH0S
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 68CC 46 KB
13 KB 185ms
85ms Script
text/html 23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=16698&endpoint=us-east&gdpr=0&us_privacy=1-N-
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: f481eaba7b96578406b524f6c3e829ee2ad77d9614952c438d05eec9a62c697b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=16698&endpoint=us-east&gdpr=0&us_privacy=1-N-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Dec 2023 16:41:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=46929
Connection: keep-alive
Content-Length: 13232
Expires: Wed, 13 Dec 2023 16:41:24 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 7754 43 B
479 B 65ms
65ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=Hz-bhPZH-3xZJd9nRju811w_&ex=sovrn.com&gdpr=0&gdpr=0&gdpr_consent=

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: WCNNWQKZZVB8ACQWREDK
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7754
Redirect Chain

https://x.bidswitch.net/sync?ssp=fmx&us_privacy=&gdpr=0&gdpr_consent=
https://sync2.resetdigital.co/csync/bs?type=d&bidswitch_ssp_id=fmx&gdpr=0&us_privacy=
https://x.bidswitch.net/sync?dsp_id=447&user_id=000001221E6850C8&expires=15&ssp=fmx
https://ce.lijit.com/merge?pid=26&3pid=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=&us_privacy=

43 B
2 KB

85ms
82ms

Image
image/gif

63.251.86.49
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=26&3pid=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol: HTTP/1.1
Server: 63.251.86.49 Beecher, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:17 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location: //ce.lijit.com/merge?pid=26&3pid=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=&us_privacy=
Date: Wed, 13 Dec 2023 03:39:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7754
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=Hz-bhPZH-3xZJd9nRju811w_&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=ZXknY3pjWFqoQ-Bgo1dESiVp

43 B
1 KB

100ms
69ms

Image
image/gif

63.251.86.49
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=ZXknY3pjWFqoQ-Bgo1dESiVp
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol: HTTP/1.1
Server: 63.251.86.49 Beecher, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Wed, 13 Dec 2023 03:39:15 GMT
server: Aorta/20231212.88a94bacf
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
location: https://ce.lijit.com/merge?pid=84&3pid=ZXknY3pjWFqoQ-Bgo1dESiVp
access-control-allow-origin: *
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: f1f2d2e17eaf
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7754
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=16&3pid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=

43 B
1 KB

165ms
74ms

Image
image/gif

63.251.86.49
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=16&3pid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol: HTTP/1.1
Server: 63.251.86.49 Beecher, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:14 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://ce.lijit.com/merge?pid=16&3pid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7754
Redirect Chain

https://ums.acuityplatform.com/tum?umid=27&uid=Hz-bhPZH-3xZJd9nRju811w_&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=66&3pid=864117689528

43 B
1 KB

159ms
70ms

Image
image/gif

63.251.86.49
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=66&3pid=864117689528
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol: HTTP/1.1
Server: 63.251.86.49 Beecher, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Access-Control-Allow-Origin: *
Location: https://ce.lijit.com/merge?pid=66&3pid=864117689528
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7754
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=87&3pid=f2c31c97-eee0-418e-8fae-cd8a32600f23

43 B
1 KB

91ms
90ms

Image
image/gif

63.251.86.49
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87&3pid=f2c31c97-eee0-418e-8fae-cd8a32600f23
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol: HTTP/1.1
Server: 63.251.86.49 Beecher, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: //ce.lijit.com/merge?pid=87&3pid=f2c31c97-eee0-418e-8fae-cd8a32600f23
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/55/4/ 256 KB
56 KB 77ms
71ms Script
text/javascript 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/55/4/common.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969dace001ef24f99f38bd00c5578b85ba9368e77a5667cfcaeaa29d2f57657b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:49:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 496182
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57512
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 22:55:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 06 Dec 2024 09:49:33 GMT

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/55/4/ 173 KB
54 KB 103ms
101ms Script
text/javascript 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/55/4/util.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e759dc710ec6d9f9438d5a77f834b247254512fb90cf520764ab591db32cf5cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:57:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 495724
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55175
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 22:55:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 06 Dec 2024 09:57:11 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 58ms
58ms Image
image/gif 54.198.156.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTQ0Njk5MDIxMCIsImVidXkiOiIyNzMxMzE1NjMzIiwiZWFkdiI6IjQ1MzIxNDMxODkiLCJlY2lkIjoiMTM4NDQ2NTc0OTE2IiwiZWVudiI6ImoiLCJlcGlkIjoiNTA2ODUyNTQiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Pacific%2FHonolulu&tzoff=600&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=158a665c-bf20-4d41-bf1f-6928c598a270&pid=b95fdc8e-6db9-4524-86e6-2fed99ef0217&dtm=1702438754561&qnm=_matherq&visible=1&tabid=20d6cd17-3152-45e1-a085-1e4a77a1cb60&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&vp=1600x1200&ds=4000x7158&tofa=1702438751&vid=1&lvidt=1702438751&duid=efb485d2-e5b6-4b64-b1da-6f3c1f491b10&fp=1905609432&cid=ma23578&mrk=239876506
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.156.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-156-105.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Wed, 13 Dec 2023 03:39:15 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame D34A 2 KB
863 B 74ms
69ms Document
text/html 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=

Requested by

Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip187.ip-51-222-39.net

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 7B33
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east

281 B
555 B

70ms
69ms

Document
text/html

23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 13 Dec 2023 03:39:15 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 13 Dec 2023 03:39:15 GMT
location: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
server: AkamaiGHost

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame AE53 2 KB
1 KB 80ms
79ms Document
text/html 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89d0ec80aa5d47245d6efb95c84fcf355b6370f445a5f883124ec98134c11f0b

Request headers

Referer: https://cdn.undertone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 834b2dcd2bf40a02-MIA
content-encoding: br
content-type: text/html
date: Wed, 13 Dec 2023 03:39:15 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NdDi%2B3rAKOsc8uhr0xNVYL43nC8xGX34I9wzV%2B1Qzu5jpX9uB%2FDRijzilXhBKWZrggqzHIVzIlM79dv4hLJPpqbFO24zvInfs4cZpw6aVfwdoWiZErXwUsYFaJPpX2FFUlKvPtaXYLxe5g%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame D2FC
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

281 B
555 B

62ms
61ms

Document
text/html

23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://cdn.undertone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 13 Dec 2023 03:39:15 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 13 Dec 2023 03:39:15 GMT
location: https://eus.rubiconproject.com/usync.html?p=12776
server: AkamaiGHost

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame BDE5
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=31a5a4fa-506a-4d8c-910c-ee56d88f2e3a

0
306 B

353ms
90ms

Image
text/plain

3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=39&uid=31a5a4fa-506a-4d8c-910c-ee56d88f2e3a
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: H2
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: Pku2WLiIe0Sp3XrQFoq6cVcRprOo6mRnnECCOefncZNHdtAedpaxHg==
x-cache: Miss from cloudfront

Redirect headers

date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usr.undertone.com/userPixel/sync?partnerId=39&uid=31a5a4fa-506a-4d8c-910c-ee56d88f2e3a
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame BDE5
Redirect Chain

https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-opaSIqdE2uGRybOAzp98FXZv1YGGoSEY~A

0
194 B

200ms
117ms

Image
text/plain

3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-opaSIqdE2uGRybOAzp98FXZv1YGGoSEY~A
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: H2
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: Oiwgjx1jBlyT5vsfZWsdGXuHY_wHBSF6AshJXDhuX5_8E09XDTvDbw==
x-cache: Miss from cloudfront

Redirect headers

location: https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-opaSIqdE2uGRybOAzp98FXZv1YGGoSEY~A
date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame BDE5
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usr.undertone.com/userPixel/sync?partnerId=46&uid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttl=1705030755

0
307 B

359ms
91ms

Image
text/plain

3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=46&uid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttl=1705030755
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: H2
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: ZeRuC5su9zwHRcVRZE2nm8iBN4fHh3_FdPBDWWTlMEIu5mIQEJon9g==
x-cache: Miss from cloudfront

Redirect headers

location: https://usr.undertone.com/userPixel/sync?partnerId=46&uid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttl=1705030755
date: Wed, 13 Dec 2023 03:39:15 GMT
server: Kestrel
content-length: 249

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame BDE5
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=12776
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LQ382S7J-12-IUP9

0
295 B

384ms
118ms

Image
text/plain

3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LQ382S7J-12-IUP9
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: H2
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: Ktk2-S38jvw_HL6BIfUmhxkT2IqyQqJVMuZ0HQg2V5KLiq6RI7WUwQ==
x-cache: Miss from cloudfront

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LQ382S7J-12-IUP9
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 382e2818ca015d35b02cd449aa60881d
Expires: 0

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame BDE5
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
https://image4.pubmatic.com/AdServer/SPug?p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3D1BB735AD-30E7-4B35-805F-E7EFB2FDA837
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837

0
312 B

91ms
90ms

Image
text/plain

3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=53&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: H2
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: SKDLSOyZovkfcwSarllq4ZImnZODxxlBFJje0hGzSQQBvYwEFuVywA==
x-cache: Miss from cloudfront

Redirect headers

location: https://usr.undertone.com/userPixel/sync?partnerId=53&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame BDE5
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553

0
317 B

260ms
91ms

Image
text/plain

3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=54&uid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: H2
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: USVuUyb8qxt5cNs3Oek10a9YsBzK9uLM0FXPR47N2iNnvbnhiTI7Dg==
x-cache: Miss from cloudfront

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://usr.undertone.com/userPixel/sync?partnerId=54&uid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame BDE5
Redirect Chain

https://ups.analytics.yahoo.com/ups/58545/occ
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-oEhoeXNE2uEABDywW2mUVaiqiTPtcdGPu4_5fgM-~A

0
316 B

261ms
122ms

Image
text/plain

3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-oEhoeXNE2uEABDywW2mUVaiqiTPtcdGPu4_5fgM-~A
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: H2
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: vt0IFtemM62mXgpGrmoV0XPnzcNIFiUyqUJHCU1qp_y_9ipluu2TPw==
x-cache: Miss from cloudfront

Redirect headers

location: https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-oEhoeXNE2uEABDywW2mUVaiqiTPtcdGPu4_5fgM-~A
date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame BDE5
Redirect Chain

https://usr.undertone.com/userPixel/syncr?gdpr=&gdprstr=&partnerId=49&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24UIDENC
https://s.amazon-adsystem.com/ecm3?ex=undertone.com&id=6d9uvmtvl3ixso5ftjjulqfke

43 B
479 B

64ms
64ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=undertone.com&id=6d9uvmtvl3ixso5ftjjulqfke

Requested by

Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:15 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: XQ3954BHRS4R6XEKGJ27
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=undertone.com&id=6d9uvmtvl3ixso5ftjjulqfke
date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: OO9PsFURKCrY8kDuIC8XPZ7IhB2CS8t6wIjlpaQeuAT71i13xZwxVw==
x-cache: Miss from cloudfront

GET
H2 200 connatix.playspace.js Show response
cds.connatix.com/p/395790/ Frame 591F 1 MB
305 KB 144ms
80ms Script
application/javascript 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/395790/connatix.playspace.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdd0e081a6f366a7c08a0cd359e98826b78da5123f0b4b57a4612801f7c6f50b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
x-amz-version-id: Pjuf_wtTVYSRsEUtfm3z.cfTwSk_dMo1
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 12 Dec 2023 13:52:18 GMT
server: cloudflare
etag: W/"e3324baf9601035d846853a47b56e507"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 834b2dcd7a0d3349-MIA
access-control-allow-headers: range
expires: Thu, 12 Dec 2024 03:39:15 GMT

GET
H2 200 / Show response
pips.taboola.com/ 4 B
125 B 35ms
34ms XHR
text/plain 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pips.taboola.com/
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: fb329000228cc5a24c264c57139de8bf854fc86fc18bf1c04ab61a2b5cb4b921

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-served-by: cache-mia-kmia1760049-MIA
date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 varnish
server: Varnish
access-control-allow-methods: GET
x-cache: HIT
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-store
accept-ranges: bytes
content-length: 4
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 70ms
57ms Image
image/gif 54.198.156.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjQxNDA3MTg5MSIsImVidXkiOiIzMjcwODY2MTM5IiwiZWFkdiI6IjUzNjQ4NDEwOTciLCJlY2lkIjoiMTM4NDUzODgzMjY5IiwiZWVudiI6ImoiLCJlcGlkIjoiNTA2ODUyNTQiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Pacific%2FHonolulu&tzoff=600&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=b3912845-6ad0-4d1f-bac5-27ae76de614a&pid=b95fdc8e-6db9-4524-86e6-2fed99ef0217&dtm=1702438754621&qnm=_matherq&visible=1&tabid=20d6cd17-3152-45e1-a085-1e4a77a1cb60&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&vp=1600x1200&ds=4000x7158&tofa=1702438751&vid=1&lvidt=1702438751&duid=efb485d2-e5b6-4b64-b1da-6f3c1f491b10&fp=1905609432&cid=ma23578&mrk=239876506
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.156.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-156-105.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Wed, 13 Dec 2023 03:39:15 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 94ms
71ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 14 Dec 2023 03:39:15 GMT

GET
H2 200 runtime_8b30b4890203fd4144c54b9ffd765f5e.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 3 KB
2 KB 45ms
30ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/runtime_8b30b4890203fd4144c54b9ffd765f5e.br.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: c4fad867557fa65e1a778e915c0b4ed0cd1bbb4443452c8943e5cec6504311e7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 17:15:44 GMT
content-encoding: br
age: 1160611
x-guploader-uploadid: ABPtcPo1lbnsYus0eZ91OCLFv3g9P2Pz0RJPrM5b1RQruWikvQHmYDsbBlHhqeMXUdDa_MLyaF4sRt8PxplrFxMiCj6E
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1317
last-modified: Wed, 29 Nov 2023 16:43:53 GMT
server: UploadServer
etag: "dbc90523c425a5d782995c1a39051881"
x-goog-generation: 1701276233202747
x-goog-hash: crc32c=Xs/EYg==, md5=28kFI8QlpdeCmVwaOQUYgQ==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 1317
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 56D6 2 KB
2 KB 318ms
54ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=62650523&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1-N-
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 99151910808966cdceb5c4e53f69ee53cc8240637bf88d4f48e1fa4c1c29ebf8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 13 Dec 2023 03:39:15 GMT
content-length: 1731
content-type: text/html; charset=UTF-8

POST
H2 200 VideoBidRequestHandlerServlet Show response
wf.taboola.com/ 4 KB
2 KB 210ms
201ms XHR
application/json 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=955&height=537&pubid=169497&tagid=953497&crid=-1&noaop=5&sortOrderType=0&cb=1702438755408&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=0&seq=1&pv=1583&pt=-1337194392&tz=-600&viewable=true&ddast=V8Kq0CLAaweienCtrrEhNg9U5OFbTXJS4AAABgYMD_AEnZdrvBbLdxK4e73Vq08k3WEotz5BauFjPbZDNzmVwTIyAp2243mO02buVwt1uLVr7JWmJxjtzC1WJmm2xmLpNrYgUewTr93Q7Ty2SQtDx-g6TlMhsUFL_tZZCxXCY3QEPT6fC57vW63--udlk-rsvz7vJ97hq_2y8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nP5yAAAAAPDg____HwIAAABABAAAAAAJAAAAABQCKvxbELgAAAAAgOH___9fA8D4BgFnlgOCu3wH5d_y9QcAAAAAEAAAAAAkABBanksAvJxEn_j_________jzFAn3kj4______GQg-ABx8AD0IAAAAuhoSPHQrFGg0oEjlQKcIIAAAAgAmhndGRSTpBxaLK__9_vxWAKwAAAYxhQctbWXQHJd7CAAAAEIxZoIfF7zc77Bq_22X-_________838n_lHIzQyM5NGeBKeVM0vIADAml9AAAA26gYA4E0AnKBD0IrBYHUUYjecLXazxXAyOwAAAAB3_v____WA3GQ12thsK8NiM9vYXMuFxWRzrnyb2cg4mpkms-2RDEGn1HKprujjEazT3-0wvUwGScvjN0haLrNBQfHbXgYZy2WynwlbjFaTyWY5nC0Xk8FwNByN9mcgJoMBmojBcjmZLCa71Wg12gx3o9lggQRiMEEULRpMVqPRZDEZrkaT1Wy52O02iKJVq9loMxiuZpPZbrcaDobL0QhN2GK0mkw2y-FsuZgMhqPhaDREMGQaTAYLj3Gt8g2Ha9HKMXMrVyuTW-JYDBajjWE4GU3cotfH9PFNFh6TzYsEA872InlapBPhzOVy7pazmWPk3ExGs43FZhtZZoPNxDlzTjamiViiOVmkE9ll35usRhubbWVYbGYbm2u5sJhszpVvMxsZRzPTZLYvmQaTwcJjXKt8w-FatHLM3MrVyuSWOBaDxWhjGE5GE7fo9TF9fJOFx2TzN3aDyWgz3K0W-8ZuMBlthrvVYt-hM3xXn7NROlmKPT6vVjRNfmxOg8JlsHinRYu0dTj6jDqvbSJMrU07x8QqtEq8BoXn4FF9TSuJ1G99iLfrjfdgVMQSwUU6UbtMTofd5fv8LH_X4a12WT6uy_Pu8n0uYonSdJFO9JLBZLNXTPaKyV7y-nyeDrtb7bC7ZWany_OWWf5ut8hldzssX7fo7xY7jG_d03R0y_1u0dPjdZneestb8PB8Dn_L6SKWCE4X6UT0Mp4u6j9qmOFcsZnMFYvhXDdYJQAAAAAAAAAASzDJdBMAAAAAJ4PazAaL1TodzGA52AxXywVQoV6jCxgEAAAAAABglxR1LuLY-2ZSscYe02iXyemwu3yfn-XvOrzVLsvHdXneXb7PlQFUpP8w2-wzgljL2bIGAAAggA0AACCA2268CTiz4v7____HAQAAAJBDDwAAwH8f0BAzMzMzczO_ghgMh5P9A1Ah1nK2ut1Yy9kKKFC7CQQACKgH!&proto=2,3,5,6&encoded=1&pstn=vforce2&callback=&wfv=1&amp=0&qsz=10&ft=0&pb=0&pagg=1&sd=0&ctsldr=0&dtagid=3090385&dpubid=536015&abtst=DLR_vA!adxsub-out_vA!adxsub-out_vB!rbcatc_vA!tmaxc_vB&mPre=0.033&cirf=https%3A%2F%2Fwww.mercurynews.com&en=1&subu=0&panid=716fd8efafe78c1d3284f497fbe7a9fb927a2e1964fff32f4b873cb31e9fbc5f
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/lite-unit/4.6.4/UnitRecoReelWidgetDesktop.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: c478c495cda0cb4c8416b60ba4973b70f843ad45b7f7b765d68a7c099538a056

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-type: text/plain

Response headers

x-cache-hits: 0
date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
via: 1.1 varnish
machineid: 1182
x-cache: MISS
x-served-by: cache-mia-kmia1760053-MIA
pragma: no-cache
server: nginx
x-timer: S1702438755.434737,VS0,VE170
vary: Accept-Encoding
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
accept-ranges: bytes
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 0E73 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 85a2c1e1bb0683ce91e7c4b17b3d4ca2880c6c33c49ee6c32d1d80142f24b175

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame B6BA 46 KB
13 KB 114ms
63ms Script
text/html 23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: f481eaba7b96578406b524f6c3e829ee2ad77d9614952c438d05eec9a62c697b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Dec 2023 16:41:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=46929
Connection: keep-alive
Content-Length: 13232
Expires: Wed, 13 Dec 2023 16:41:24 GMT

GET
H2 204 / Show response
cds.taboola.com/ 0
82 B 249ms
67ms XHR
text/plain 141.226.224.32
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.taboola.com/?uid=d4020ac8-e788-4e1f-95ed-b11014c0824b-tuctc72acdf&mbl=ZmFsc2U=
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-store
server: nginx

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3FD1 46 KB
13 KB 93ms
75ms Script
text/html 23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: f481eaba7b96578406b524f6c3e829ee2ad77d9614952c438d05eec9a62c697b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Dec 2023 16:41:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=46929
Connection: keep-alive
Content-Length: 13232
Expires: Wed, 13 Dec 2023 16:41:24 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 0E73 0
0 106ms
106ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv7DDIOYbek8GOL3p3GNhQ3CfUcYGTrlRgahsoRzjsCZMgZqKzQQR_DB1VWwb6PFWJOMis5GKBDN8vO8zMzCVes-Up2MTrVj4KPpUbKGhN5nBkFZcJ2KvVrLW37_JFj3X_1OsHSOgxcodr62O0H8gxLK-91MR0AiMEt7O--Jrf35MPYBKyNhSdCF64pMzC1aG4iRPCFTZt3Mk5r0cmhMnryXwI_f-L0-L6dx0ghmQAMzSCNZqjgVhtXsNNoIc0UtkHS4vq42ZkDLi2qgOumGj3SYEFkaCVRz-exLIgMy44aG2bq3YpZ-1j2Rfr8FUTK54_pVM5F3T1Rn-xOi-8GDChFW9bJP3c7HyxSqJ5z91OJV8kRhQLGEciH09wX24AvhpTwtVQ7yQ&sai=AMfl-YRozLX8fq4g93IzOWXr86n_HlQTR33yi3AmGyT085t58XxT2WwsP-Mr4IgoSy1Dpt_JvVdreo3k7Q2c-gFXxor4A9-r4Y4uLSVZ1ODmYHab-97pFpbam5AgyDLrGbI&sig=Cg0ArKJSzM09Fw71oar9EAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 13 Dec 2023 03:39:15 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame FC10 7 B
798 B 274ms
62ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&us_privacy=1-N-
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: f84b118a3f01dd6ffa744f6af941f4e8
Expires: 0

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame AE53
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESENBu8508h7VqvbX5sx1zEMg&google_cver=1

43 B
735 B

80ms
79ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESENBu8508h7VqvbX5sx1zEMg&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1i79TIwrvXETRA0bj6Nfjgg44O1bVW4Y5ORRbd4a6ZVvqBmtuC3N%2FvWCmFdbqAzqqRgKkQQKb4pG3OXCsUzEFoFWd5GH%2F%2FJcFUbdrYXPd2fvD7uSr5MoflAGgV4EIoxE07FW%2FBSniYVyBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 834b2dcebdb10a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESENBu8508h7VqvbX5sx1zEMg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame AE53 43 B
602 B 61ms
60ms Image
image/gif 2600:1f18:4e9:5a02:d4c8:9f2:5a1a:543f
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:d4c8:9f2:5a1a:543f Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET

user-registering
ads.stickyadstv.com/ Frame AE53
Redirect Chain

https://ads.stickyadstv.com/user-registering?dataProviderId=1025&userId=ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://1f2e7.v.fwmrm.net/ad/u?_dv=2&dsp_user_mapping=true&127719=a571c37c266940a3e482ae33355490&rdU=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D1169%26userId%3d%23%7bus...
https://ads.stickyadstv.com/user-registering?dataProviderId=1169&userId=umo0447_7313616546294522610&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm=&google_sc&google_hm=YTU3MWMzN2MyNjY5NDBhM2U0ODJhZTMzMzU1NDkw&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEAH6Qgb-3eLzCuabNSxEL-4&google_cver=1&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/stv?gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?userId=AAAZ7E7K8k8AABRIfwE1Og&dataProviderId=817&gdpr=0
https://pr-bh.ybp.yahoo.com/sync/stickyads/a571c37c266940a3e482ae33355490?gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=199&userId=y-2rhc62JE2oPJ3Cme4isxgwgiG2nJTyMWySBfW_We~A
https://match.adsrvr.org/track/cmf/generic?ttd_pid=stickyads&ttd_tpi=1
https://ads.stickyadstv.com/user-registering?dataProviderId=208&userId=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D209%26userId%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=209&userId=2419896334597204579&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

0
0

GET
H2

200

ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame AE53
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://pr-bh.ybp.yahoo.com/sync/casale/ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB

43 B
602 B

62ms
62ms

Image
image/gif

2600:1f18:4e9:5a02:d4c8:9f2:5a1a:543f
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D

Protocol

Server

2600:1f18:4e9:5a02:d4c8:9f2:5a1a:543f Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB
date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame AE53
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=7364974048145578927&gdpr=0&gdpr_consent=

43 B
736 B

81ms
81ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=7364974048145578927&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HAjVPA5uztmNU4TtVm%2FfdTcDBgQYRL908gJ8RaSmbd0F1hPct5XrM55qJwf%2Bmd8XN4xuTmgZDgfFzveHFhy9%2Bl%2FRi9vXkTpAE%2F63Uc831jKMNL%2Fejg4WinuueqeP9RyNqbfTOpz5tcQCHg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 834b2dcfbf170a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=7364974048145578927&gdpr=0&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:15 GMT
content-length: 0

GET
H2 200 ibs:dpid=23728&dpuuid=ZXknYtLdjQGqeEc7lLJVmwAA%262891
dpm.demdex.net/ Frame AE53 42 B
713 B 62ms
60ms Image
image/gif 34.234.28.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=ZXknYtLdjQGqeEc7lLJVmwAA%262891?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.234.28.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

dcs: dcs-prod-va6-1-v053-0252081f9.edge-va6.demdex.com 2 ms
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: 1sP4/cDHRt4=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame AE53
Redirect Chain

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.ca...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662090854304492

43 B
735 B

84ms
83ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662090854304492
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9n%2BkJCdhIS%2F7PltR98WDaEo6Sz%2FnnvOSM26xcQC4FecKxZCWaSps5yGj8c%2BBhn19iCk1R8t9MoCcDDYoAzAPtjtEnTR%2FS5ZlG4AEkofwC8vB7JnY6esmb35epB6xd%2BCO9GdRtQu4txhugA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 834b2dd0a81c0a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 261
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662090854304492
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 834b2dcfd9f767b1-MIA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 sync
usr.undertone.com/userPixel/ Frame AE53 0
307 B 175ms
116ms Image
text/plain 3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=57&uid=ZXknYtLdjQGqeEc7lLJVmwAAC0sAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: zJKW1MJxAxbbTNqAQG0PAJ9X0P2RSLb2HEYvKg1d0hVbGaCCiPAPgA==
x-cache: Miss from cloudfront

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 59ms
57ms Image
image/gif 54.198.156.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjE1OTUyMjkwMiIsImVidXkiOiIzMTExNzIwODQzIiwiZWFkdiI6IjUyMzM1MDI2MzYiLCJlY2lkIjoiMTM4NDEzNTIwMzUyIiwiZWVudiI6ImoiLCJlcGlkIjoiNTA2ODUyNTQiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Pacific%2FHonolulu&tzoff=600&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=68a10dab-08c4-4dca-a026-1c59aebf2c49&pid=b95fdc8e-6db9-4524-86e6-2fed99ef0217&dtm=1702438755439&qnm=_matherq&visible=1&tabid=20d6cd17-3152-45e1-a085-1e4a77a1cb60&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&vp=1600x1200&ds=4000x7158&tofa=1702438751&vid=1&lvidt=1702438751&duid=efb485d2-e5b6-4b64-b1da-6f3c1f491b10&fp=1905609432&cid=ma23578&mrk=239876506
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.156.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-156-105.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Wed, 13 Dec 2023 03:39:15 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 68CC 7 B
798 B 240ms
59ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&us_privacy=1-N-
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: b08c627b67f10e75995ce6908d3f9f7b
Expires: 0

GET
H3

200

crum Show response
dsum-sec.casalemedia.com/ Frame F1CD
Redirect Chain

https://um4.eqads.com/um/cs
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=065257c5-7416-49c2-be5f-e367187e74e9&expiration=1710301155

43 B
739 B

88ms
88ms

Document
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=065257c5-7416-49c2-be5f-e367187e74e9&expiration=1710301155
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ssum-sec.casalemedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 834b2dd138f20a02-MIA
content-length: 43
content-type: image/gif
date: Wed, 13 Dec 2023 03:39:16 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EFbrpZ9Jc2wKU%2BpTD%2Fu1k4SCpEPRZ7F0t5LS167Kxk6MXkzuOTUXu9sZaY3p93HEwV7j6OCNKk30mzMfISIH%2BrwpXkXO%2BJmEhlOBm7Dm9fJN%2B9QPdGxOBQcmdgPZefBzONB%2FzuAId11PYA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

cache-control: no-cache
content-length: 0
date: Wed, 13 Dec 2023 03:39:15 GMT
expires: 0
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=065257c5-7416-49c2-be5f-e367187e74e9&expiration=1710301155

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
742 B 58ms
57ms Fetch
application/json 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=c4rybxe&fmt=json
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: eedbffb66f189ac0eebfded73abefe7fa188dfe93e077faaf3ee837492a38efe

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
expires: Fri, 12 Jan 2024 03:39:15 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1-N-&gdpr=0&gdpr_consent=undefined&ust=image
https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c

0
338 B

235ms
57ms

Image
text/plain

50.17.219.25
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 50.17.219.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-219-25.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-served-by: beacon-n022-ash-prod.krxd.net
date: Wed, 13 Dec 2023 03:39:16 GMT
cache-control: private, no-cache, no-store
x-request-time: D=33 t=1702438756
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
date: Wed, 13 Dec 2023 03:39:16 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a005-ash-prod.krxd.net

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame D2FC 46 KB
13 KB 78ms
75ms Script
text/html 23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: f481eaba7b96578406b524f6c3e829ee2ad77d9614952c438d05eec9a62c697b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=12776
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Dec 2023 16:41:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=46929
Connection: keep-alive
Content-Length: 13232
Expires: Wed, 13 Dec 2023 16:41:24 GMT

GET
H3 200 main-v2_6cf6a022d7093e7ac6bcdb76674a8d23.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 452 KB
101 KB 34ms
32ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_6cf6a022d7093e7ac6bcdb76674a8d23.br.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 1c494e9547adc925a653a4dddacb93cafbe7a9509ece1bda35dc08b406c99a75

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 15:58:43 GMT
content-encoding: br
age: 128432
x-guploader-uploadid: ABPtcPo2O7WXPKtXZmUGNHXaKsk37tltvcfPMhZuejJ1sHGTc9cIBfo6bgEowVNT1TgfQxNS6a5Oa3ER_gv4u5eZ4PgSmA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103129
last-modified: Mon, 11 Dec 2023 15:58:33 GMT
server: UploadServer
etag: "39e9f4f445cd438e4f7eebe4716243b0"
x-goog-generation: 1702310313901861
x-goog-hash: crc32c=P+glUg==, md5=Oen09EXNQ45PfuvkcWJDsA==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 103129
accept-ranges: bytes
content-type: text/javascript

GET
H3 200 cjs_min_e56025bf788e01599545a68c3c69921e.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 48 KB
15 KB 38ms
35ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_e56025bf788e01599545a68c3c69921e.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: ab972f6a39ea0cc174d842ee8e05040126ae6ff7a9cb1ba71832891f65b777c9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 17:33:01 GMT
content-encoding: gzip
age: 641174
x-guploader-uploadid: ABPtcPo0stK9sXarw1q0sITooITfqxXtdzE0EaXzAd-458DrHgsZEN7A51fhn7JotFa_PPEAN8BLu_FeLh8c4IEHcD9FTw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15456
last-modified: Mon, 30 Oct 2023 15:16:33 GMT
server: UploadServer
etag: "26c0a67ac86badefc2bd96cdcdb2c5d8"
x-goog-generation: 1698678993576874
x-goog-hash: crc32c=yJ1HXQ==, md5=JsCmeshrre/CvZbNzbLF2A==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000,no-transform
x-goog-stored-content-length: 15456
accept-ranges: bytes
content-type: text/javascript; charset=utf-8

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 7B33 46 KB
13 KB 81ms
73ms Script
text/html 23.56.213.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.213.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: f481eaba7b96578406b524f6c3e829ee2ad77d9614952c438d05eec9a62c697b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Dec 2023 16:41:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=46929
Connection: keep-alive
Content-Length: 13232
Expires: Wed, 13 Dec 2023 16:41:24 GMT

GET
H2 200 cSyncRemoteEntry.js Show response
cds.connatix.com/p/395790/ Frame 591F 3 KB
2 KB 44ms
43ms Script
application/javascript 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/395790/cSyncRemoteEntry.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f5cea81bb63d0214976da19bc823736066909b01efa7bf8cdb4d5de805eea93

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
x-amz-version-id: 9BuYz4RgLGcYax5h3UtjApdD3wa4u7JI
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 12 Dec 2023 13:52:21 GMT
server: cloudflare
etag: W/"d60d811350d7df0f4503ae40d8a9728a"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 834b2dcfbddb3349-MIA
access-control-allow-headers: range
expires: Thu, 12 Dec 2024 03:39:15 GMT

GET
H2 200 connatix.playspace.css
cds.connatix.com/p/395790/ 117 KB
18 KB 45ms
44ms Stylesheet
text/css 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/395790/connatix.playspace.css
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 52bc8e71a34490457c6bc6b85a7e4f737f0431abb69e535556d03e838b810f7b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
x-amz-version-id: zNzpgNT5jc41NXw4_VBCFIDBLBTExjsg
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 12 Dec 2023 13:52:18 GMT
server: cloudflare
etag: W/"857ea9b3d964e5d7626a47029ecff794"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: text/css
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 834b2dcfbddf3349-MIA
access-control-allow-headers: range
expires: Thu, 12 Dec 2024 03:39:15 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame B6BA 7 B
798 B 61ms
61ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&us_privacy=1-N-
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Expires: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame FC10
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&us_privacy=1-N-&khaos=LQ382S7J-12-IUP9
https://s.amazon-adsystem.com/ecm3?id=LQ382S7J-12-IUP9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1-N-

43 B
479 B

64ms
64ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LQ382S7J-12-IUP9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1-N-

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: WXNZNX2W8Z33NADVVX08
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LQ382S7J-12-IUP9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
Expires: 0

POST
H2 200 155 Show response
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 189 B
1 KB 94ms
92ms XHR
application/json 18.164.96.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/155?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&bcsessionid=27e4b7f9-48fd-440e-b9bc-b946fde0e8e5&bctempid=&overruleReferrer=&time=2023-12-12T17%3A39%3A15-10%3A00&ts=1702438755814

Requested by

Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

- /

Resource Hash

9d78f874fb17977391381eb7579cd2dd27160855ccb60fbdbbba0a628c35b948

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 169
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
accept-ch: sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: bnftkr7ZtZWf_EVzfOpr69PLgLd7qJsuQC8Syf2oKDrhqT2qy2qQww==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 3FD1 7 B
798 B 59ms
58ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&us_privacy=1-N-&khaos=LQ382S7J-12-IUP9
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: f84b118a3f01dd6ffa744f6af941f4e8
Expires: 0

GET
H2

200

/
sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/ Frame 68CC
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=16698&gdpr=0&us_privacy=1-N-&gdpr=0&us_privacy=1-N-&khaos=LQ382S7J-12-IUP9
https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
372 B

72ms
72ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 71085

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
Expires: 0

GET
H3 200 onsite-v2_5631bf90701659009118a89f964ae570.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 16 KB
5 KB 36ms
35ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/onsite-v2_5631bf90701659009118a89f964ae570.br.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: eddc11d8be0ae5311acc08d5f2ebe7ff9426384f6408ecbb56abbd7fb5e03743

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:24:21 GMT
content-encoding: br
age: 2261694
x-guploader-uploadid: ABPtcPqYByKaKMknWV2kKfvREuE2TxpL4J1O-J7lktm26VZPUvr0nBx296A8QWVV2OomjQyq7hByQJ73B_90C2vTKkG4QEDizNXD
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4962
last-modified: Mon, 13 Nov 2023 15:33:43 GMT
server: UploadServer
etag: "801d41813e7b11c4986b4ca00307283b"
x-goog-generation: 1699889623529535
x-goog-hash: crc32c=+KL22A==, md5=gB1BgT57EcSYa0ygAwcoOw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 4962
accept-ranges: bytes
content-type: text/javascript

GET
H3 200 ads-v2_be6778ce7d0f98930697120977c2eaad.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 172 KB
38 KB 36ms
35ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ads-v2_be6778ce7d0f98930697120977c2eaad.br.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: bc6e6b2f2af956ddb9d57142d5939ccce581db46d090cf3a4188c61b0dd358a1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 15:58:29 GMT
content-encoding: br
age: 128446
x-guploader-uploadid: ABPtcPqyh6CBhFCuQ8sOZ4Y2UL2TM2exDmTY-hOrDVZgWHD9nZm-8yygY-sHS0JJQ-ZF6WQPaCDcUJ8_HkVlMxXbLCYbLw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38610
last-modified: Mon, 11 Dec 2023 15:58:18 GMT
server: UploadServer
etag: "ceb6453503a59eaad00f4d3cae4d279d"
x-goog-generation: 1702310298652752
x-goog-hash: crc32c=snmKLA==, md5=zrZFNQOlnqrQD008rk0nnQ==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 38610
accept-ranges: bytes
content-type: text/javascript

GET
H3 200 7f273be8970325daff05b7eb41c4dd09.br.json Show response
assets.bounceexchange.com/assets/gam/8013/ 249 KB
60 KB 111ms
42ms Fetch
text/plain 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/gam/8013/7f273be8970325daff05b7eb41c4dd09.br.json
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_6cf6a022d7093e7ac6bcdb76674a8d23.br.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 0dbd291d9ffb220f6470fd888d47ffed6ccd00c783c9de1339d678fec47a2937

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 01:03:53 GMT
content-encoding: br
age: 9322
x-guploader-uploadid: ABPtcPoTnrTxLmudWIzC16Bs-LTx_C4aQyYS2Rgk7FHNCw6rhJkBqpfSPmUXxDVSxaH_5rxFTgpg4T0Y4_2_qWpu-4bjNT_ol5Wf
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61168
last-modified: Wed, 13 Dec 2023 01:02:34 GMT
server: UploadServer
etag: "450136af95eb122a2c4dcb4ae879c91d"
x-goog-generation: 1702429354697499
x-goog-hash: crc32c=pUINIQ==, md5=RQE2r5XrEiosTctK6HnJHQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace, etag
cache-control: public,max-age=31536000
x-goog-stored-content-length: 61168
accept-ranges: bytes
content-type: text/plain; charset=UTF-8

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame EA3A 43 B
855 B 66ms
64ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:15 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: BBWSYX602HBE0H2DSPYV

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame E248 43 B
479 B 70ms
68ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID1BB735AD-30E7-4B35-805F-E7EFB2FDA837

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:15 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 85ECR2BM2EXHEM1DW71W

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 56D6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=G7c1rTDnSzWAX-fvsv2oNw%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

52ms
45ms

Image
text/html

23.216.84.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Server: 23.216.84.200 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-216-84-200.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=151603
accept-ranges: bytes
content-length: 5622
expires: Thu, 14 Dec 2023 21:45:59 GMT

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 56D6
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Df2ab11c6-9b76-4f61-9ae1-0e1fe25e4115%252C%252C
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=2419896334597204579&pt=f2ab11c6-9b76-4f61-9ae1-0e1fe25e4115%2C%2C

95 B
124 B

63ms
63ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=2419896334597204579&pt=f2ab11c6-9b76-4f61-9ae1-0e1fe25e4115%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
an-x-request-uuid: ec6c56a1-21fe-4301-9ae3-a54b72b0dd5d
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=2419896334597204579&pt=f2ab11c6-9b76-4f61-9ae1-0e1fe25e4115%2C%2C
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 403 FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame 56D6 0
0 198ms
58ms Image
text/html 40.76.134.238
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%201BB735AD-30E7-4B35-805F-E7EFB2FDA837&rnd=RND
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 40.76.134.238 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H2 200 xuid
eb2.3lift.com/ Frame 56D6 37 B
353 B 63ms
60ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7976&xuid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 56D6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECcdXky8ZyIljSUixuFF-Ig&google_cver=1

42 B
348 B

67ms
63ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECcdXky8ZyIljSUixuFF-Ig&google_cver=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECcdXky8ZyIljSUixuFF-Ig&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 56D6
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:BCA2A12E8DA9409D83F5E5E2B0607EA3

42 B
402 B

63ms
63ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:BCA2A12E8DA9409D83F5E5E2B0607EA3
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:16 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Wed, 13 Dec 2023 03:39:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:BCA2A12E8DA9409D83F5E5E2B0607EA3
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 12 Dec 2023 03:39:16 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 56D6
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=

42 B
392 B

64ms
56ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:15 GMT
server: Kestrel
content-length: 355

GET
H2 200 1BB735AD-30E7-4B35-805F-E7EFB2FDA837
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 56D6 43 B
602 B 63ms
61ms Image
image/gif 2600:1f18:4e9:5a02:d4c8:9f2:5a1a:543f
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/1BB735AD-30E7-4B35-805F-E7EFB2FDA837?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:d4c8:9f2:5a1a:543f Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 56D6
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-IwwSDqBE2uU2sIBojbsISwuTvo1EGew-~A&gdpr=0

0
128 B

65ms
57ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-IwwSDqBE2uU2sIBojbsISwuTvo1EGew-~A&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-IwwSDqBE2uU2sIBojbsISwuTvo1EGew-~A&gdpr=0
date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK / Show response
data.cdnbasket.net/ 14 B
338 B 231ms
73ms XHR
application/json 35.244.255.197
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_e56025bf788e01599545a68c3c69921e.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.255.197 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 197.255.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 22f4fc9d0a800ed9f873e4251c327dc4ecae1cd999514beb65e23046bf4e2c65

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
page.cdnbasket.net/ 14 B
338 B 206ms
69ms XHR
application/json 35.244.216.63
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://page.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_e56025bf788e01599545a68c3c69921e.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.216.63 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 63.216.244.35.bc.googleusercontent.com
Software: /
Resource Hash: bafc057ab257c7b3b70c1d4a8ac9dea811b129932ebe197450560d4bfcb2eee4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
view.cdnbasket.net/ 14 B
338 B 205ms
69ms XHR
application/json 35.244.232.174
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://view.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_e56025bf788e01599545a68c3c69921e.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.232.174 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 174.232.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 8548c33c1ecc71c651c0669b1e493fb336b002acc712610e14d5adabac1bbe8c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame D2FC 7 B
798 B 62ms
61ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&us_privacy=1-N-&khaos=LQ382S7J-12-IUP9
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
Expires: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 7B33 7 B
798 B 62ms
61ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&us_privacy=1-N-&khaos=LQ382S7J-12-IUP9
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: c1df09169f58a071f2a391dff1b3307b
Expires: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame FC10
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&gdpr=0&us_privacy=1-N-
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
516 B

196ms
120ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:15 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: D0DE32A63EEF484CADD5EC0C0A72D9E5 Ref B: MIAEDGE1515 Ref C: 2023-12-13T03:39:16Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYMW+lQx8+covNKqwApIg==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FC10
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHXl6cVeH74M6UPc11-ve54&google_cver=1

42 B
864 B

206ms
58ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHXl6cVeH74M6UPc11-ve54&google_cver=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHXl6cVeH74M6UPc11-ve54&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 337
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FC10
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&gdpr=0&us_privacy=1-N-
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFEzODJTN0otMTItSVVQOQ==&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESEFsgApGZDfStDQKOb5yaSNs&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFEzODJTN0otMTItSVVQOQ==&google_push=&gdpr=0

170 B
188 B

102ms
101ms

Image
image/png

172.217.13.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFEzODJTN0otMTItSVVQOQ==&google_push=&gdpr=0

Requested by

Protocol

Server

172.217.13.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFEzODJTN0otMTItSVVQOQ==&google_push=&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
Expires: 0

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame FC10 43 B
855 B 507ms
216ms Image
image/gif 67.220.228.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0&us_privacy=1-N-

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.220.228.200 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: NC4QR1C0PA0PK7ZNJB2Y
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FC10
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0&us_privacy=1-N-
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTBhNDNjNmU4ODQ4Y2YyMTE1MmY2YzExMWU1YTdjZjUxMjBiNDdjMA&gdpr=0&us_privacy=1-N-

170 B
188 B

94ms
94ms

Image
image/png

172.217.13.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTBhNDNjNmU4ODQ4Y2YyMTE1MmY2YzExMWU1YTdjZjUxMjBiNDdjMA&gdpr=0&us_privacy=1-N-

Requested by

Protocol

Server

172.217.13.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTBhNDNjNmU4ODQ4Y2YyMTE1MmY2YzExMWU1YTdjZjUxMjBiNDdjMA&gdpr=0&us_privacy=1-N-
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET

5386
tags.bluekai.com/site/ Frame FC10
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?gdpr=0&us_privacy=1-N-
https://dpm.demdex.net/ibs:dpid=903&dpuuid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=2419896334597204579&ttd_tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YWYwZTU1N2ItYTZkNy00M2M5LWFlMjMtN2NkZWRmZTRlYTRj&gdpr=0&gdpr_consent=&ttd_tdid=af0e557b-a6d7-43c9-ae23-7cded...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&google_gid=CAESELkR0xLU5Qpi8oU8W8MqiJQ&google_cver=1
https://tags.bluekai.com/site/5386?id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
https://tags.bluekai.com/site/5386?id=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&gdpr=0&gdpr_consent=

0
0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame FC10
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=0AjQ-XWyTF6cSpTl7SZeFg&rk=usync-na&gdpr=0
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=0AjQ-XWyTF6cSpTl7SZeFg&gdpr=0

43 B
479 B

68ms
67ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=0AjQ-XWyTF6cSpTl7SZeFg&gdpr=0

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 983YMJZGYA5VT41P20JJ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=0AjQ-XWyTF6cSpTl7SZeFg&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame FC10
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&us_privacy=1-N-
https://s.amazon-adsystem.com/ecm3?id=LQ382S7J-12-IUP9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1-N-

43 B
479 B

65ms
63ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LQ382S7J-12-IUP9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1-N-

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: MDX7DVZZ9N1GM78EAA14
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LQ382S7J-12-IUP9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: eea754ae2ea80a3b4eb2fcf35349058a
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FC10
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0&us_privacy=1-N-
https://pr-bh.ybp.yahoo.com/sync/rubicon/JgPAf3rOqQ9NzdoSyeSP2Mn5EUdSAgOZEtemQ7w0kco?csrc=&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-dYExbKlE2oLqiYEIS9UZy4dYlKefB1IVx89_qA--~A

42 B
864 B

838ms
63ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-dYExbKlE2oLqiYEIS9UZy4dYlKefB1IVx89_qA--~A
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 5e07703167439847c6c49a939083c0fd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Wed, 13 Dec 2023 03:39:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-dYExbKlE2oLqiYEIS9UZy4dYlKefB1IVx89_qA--~A
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FC10
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAAZ7E7K8k8AABRIfwE1Og&expires=30&gdpr=0

42 B
864 B

228ms
60ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAAZ7E7K8k8AABRIfwE1Og&expires=30&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: f84b118a3f01dd6ffa744f6af941f4e8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAAZ7E7K8k8AABRIfwE1Og&expires=30&gdpr=0
Date: Wed, 13 Dec 2023 03:39:15 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

v1
match.sharethrough.com/sync/ Frame FC10
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr=0&us_privacy=1-N-
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

68 B
279 B

57ms
57ms

Image
image/png

3.213.124.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Server: 3.213.124.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-124-140.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 78008fe701b681dce86a72fc23cacc40
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FC10
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=4c48eca0-1acd-49bc-ab52-5fd54049c3ec&expires=30&gdpr=0&us_privacy=1-N-

42 B
864 B

232ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=4c48eca0-1acd-49bc-ab52-5fd54049c3ec&expires=30&gdpr=0&us_privacy=1-N-
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 382e2818ca015d35b02cd449aa60881d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=4c48eca0-1acd-49bc-ab52-5fd54049c3ec&expires=30&gdpr=0&us_privacy=1-N-
Date: Wed, 13 Dec 2023 03:39:16 GMT
Connection: keep-alive
X-CI-RTID: 39ff7ae8-a641-4443-83e3-d82ca8f2ac52
Content-Length: 175
Content-Type: text/html; charset=utf-8

GET
H2

200

pixel
capi.connatix.com/us/ Frame FC10
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&gdpr=0&us_privacy=1-N-
https://capi.connatix.com/us/pixel?puid=LQ382S7J-12-IUP9&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&us_privacy=1-N-

82 B
82 B

100ms
93ms

Image
image/gif

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=LQ382S7J-12-IUP9&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&us_privacy=1-N-
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-minuteMedia_n-MediaNet_smrt_cnv_n-smaato_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 834b2dd73aa23349-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://capi.connatix.com/us/pixel?puid=LQ382S7J-12-IUP9&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
Expires: 0

GET

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame FC10
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis&gdpr=0&us_privacy=1-N-
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQ382S7J-12-IUP9
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQ382S7J-12-IUP9&ckls=true&ci=OsJe1ii625&nc=false&trid=180233987

0
0

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame FC10
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn&gdpr=0&us_privacy=1-N-
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

43 B
1 KB

69ms
69ms

Image
image/gif

68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

Requested by

Protocol

Server

68.67.160.132 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
an-x-request-uuid: 3aa746b2-8986-4ea6-8e8e-4c78702ab0d1
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
Expires: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame FC10
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1&gdpr=0&us_privacy=1-N-
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

95 B
124 B

65ms
64ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1df09169f58a071f2a391dff1b3307b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 34ms
33ms Script
application/x-javascript 2606:2800:11f:17a5:191a:18d5:537:22f9
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mic/9B3E) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 13 Dec 2023 03:39:16 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 716
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (mic/9B3E)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 29eced02-f01e-0025-6974-2d8eb2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Wed, 13 Dec 2023 04:09:16 GMT

GET
H2 200 index.js Show response
cdn.pranmcpkx.com/ 7 KB
3 KB 45ms
34ms Script
text/javascript 2606:2800:11f:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pranmcpkx.com/index.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mic/9B0A) /
Resource Hash: 6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 13 Dec 2023 03:39:16 GMT
content-encoding: gzip
content-md5: nynBpfvYghYqzIzsvfssRw==
age: 575608
x-cache: HIT
content-length: 2382
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jun 2022 17:08:13 GMT
server: ECAcc (mic/9B0A)
etag: 0x8DA5083F65AD9E0
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
x-ms-request-id: 2722cede-901e-0033-6239-28a815000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19

GET
H2 200 DFM__BANGWPPRODWAB__MERC.json Show response
cdn.pranmcpkx.com/prod/data/dfm/ 2 MB
76 KB 174ms
173ms Fetch
application/json 2606:2800:11f:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pranmcpkx.com/prod/data/dfm/DFM__BANGWPPRODWAB__MERC.json?_=1702438756018
Requested by: Host: cdn.pranmcpkx.com
URL: https://cdn.pranmcpkx.com/prod/dfm/t8y9347t.min.js?20231112
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 8b2225731f5b6d21895e4b5dafc4ff4eefa8450113b5aedfaf89792174fbe386

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: AppendBlob
date: Wed, 13 Dec 2023 03:39:15 GMT
content-encoding: gzip
last-modified: Tue, 12 Dec 2023 15:54:54 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-committed-block-count: 1
etag: 0x8DBFB2AAEE6885F
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 543a8f3d-701e-0004-1a75-2d7ab9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
cache-control: no-cache
x-ms-version: 2009-09-19
content-length: 77305

GET
H/1.1 200
OK ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 631 B
1 KB 231ms
84ms Image
image/jpeg 52.217.92.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.92.12 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:17 GMT
Last-Modified: Tue, 15 Oct 2019 13:44:16 GMT
Server: AmazonS3
x-amz-request-id: CHM6KTTW5YDPXYDP
ETag: "ef2cc7f55b7ab677b023e36033e26471"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 631
x-amz-id-2: m2Mwyns1SHyykaaXmASyZZTgyE6etaBJPWmT/utU/DAX3RUDn4y6KdbEblRznayG6b76g49XKnY=
x-amz-meta-s3b-last-modified: 20191015T134358Z

GET
H2

204

sync
ups.analytics.yahoo.com/ups/58160/ Frame 68CC
Redirect Chain

https://token.rubiconproject.com/token?pid=26594&gdpr=0&us_privacy=1-N-
https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LQ382S7J-12-IUP9&redir=true&gdpr=0&us_privacy=1-N-

0
38 B

62ms
59ms

Image
text/plain

34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LQ382S7J-12-IUP9&redir=true&gdpr=0&us_privacy=1-N-

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Location: https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LQ382S7J-12-IUP9&redir=true&gdpr=0&us_privacy=1-N-
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame 68CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&us_privacy=1-N-
https://prebid.a-mo.net/setuid/magnite?uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
147 B

67ms
56ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 20e8391fc78a9019eb67dba4b22f0ac2
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 68CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&us_privacy=1-N-
https://ce.lijit.com/merge?pid=80&3pid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

43 B
2 KB

71ms
69ms

Image
image/gif

63.251.86.49
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 63.251.86.49 Beecher, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=80&3pid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1df09169f58a071f2a391dff1b3307b
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 68CC
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1164&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=2531413247159590299

42 B
864 B

222ms
62ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=2531413247159590299
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: e71ccbe96f42d70fa40603ada4c96b28
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=2531413247159590299
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 68CC
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=6&p=70&cp=Rubicon&cu=1&url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D6434%26nid%3D2149%26put%3D%40%40CRITEO_USERID%40%40&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=4cf89b1e-3c16-4240-835a-8a2e9a220a72&gdpr=0&us_privacy=1-N-

42 B
864 B

222ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=4cf89b1e-3c16-4240-835a-8a2e9a220a72&gdpr=0&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=4cf89b1e-3c16-4240-835a-8a2e9a220a72&gdpr=0&us_privacy=1-N-
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1286742
content-length: 0
expires: Wed, 13 Dec 2023 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 68CC
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=14&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=-tBDgfwlV_hvwp42xPpc4iaEdkY

42 B
864 B

224ms
61ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=-tBDgfwlV_hvwp42xPpc4iaEdkY
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 8bab65602db075726861004da5629947
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=-tBDgfwlV_hvwp42xPpc4iaEdkY
Date: Wed, 13 Dec 2023 03:39:16 GMT
Connection: keep-alive
Content-Length: 121
Content-Type: text/html; charset=utf-8

GET
H2

204

Rubicon
s.seedtag.com/cs/cookiesync/ Frame 68CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=seedtag&gdpr=0&us_privacy=1-N-
https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
284 B

173ms
63ms

Image
text/plain

34.149.50.64
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 34.149.50.64 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 64.50.149.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
via: 1.1 google
access-control-allow-credentials: true
server: openresty
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT, HEAD

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 68CC
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=c91bfcce-bb43-46f7-b14e-567c0a4332b3&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=71772&nid=3664&put=89badb4f-9b70-4fa0-b8ea-d11c532476e8

42 B
864 B

900ms
70ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=71772&nid=3664&put=89badb4f-9b70-4fa0-b8ea-d11c532476e8
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: c1df09169f58a071f2a391dff1b3307b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-servername: Track002-iad
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:00 GMT
strict-transport-security: max-age=31536000;
content-type: text/html; charset=utf-8
location: https://pixel.rubiconproject.com/tap.php?v=71772&nid=3664&put=89badb4f-9b70-4fa0-b8ea-d11c532476e8
cache-control: private,no-cache
content-length: 223
expires: -1

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 68CC
Redirect Chain

https://ad.turn.com/r/cs?pid=6&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=3840816935748909997&expires=60&gdpr=0&gdpr_consent=

42 B
864 B

221ms
58ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=3840816935748909997&expires=60&gdpr=0&gdpr_consent=
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=3840816935748909997&expires=60&gdpr=0&gdpr_consent=
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:15 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 68CC
Redirect Chain

https://secure.adnxs.com/getuidnb?https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4894%26nid%3D1986%26put%3D$UID%26expires%3D30&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=4894&nid=1986&put=2419896334597204579&expires=30&gdpr=0&us_privacy=1-N-

42 B
864 B

208ms
63ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4894&nid=1986&put=2419896334597204579&expires=30&gdpr=0&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
an-x-request-uuid: 1cdc1b6c-05c8-4ca1-bd3b-b9fb21e7b277
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://pixel.rubiconproject.com/tap.php?v=4894&nid=1986&put=2419896334597204579&expires=30&gdpr=0&us_privacy=1-N-
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 68CC
Redirect Chain

https://sync.1rx.io/usersync2/rubicon?gdpr=0&us_privacy=1-N-
https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D186028%26nid%3D4112%26put%3DRX-72d673f8-1f56-4b...
https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005&expires=30&us_privacy=1-N-

42 B
864 B

842ms
65ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005&expires=30&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005&expires=30&us_privacy=1-N-
date: Wed, 13 Dec 2023 03:39:16 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX72d673f81f564be7bc9e8afa79a8599a005
content-type: text/html

GET
H/1.1

204
No Content

esync
token.rubiconproject.com/ Frame 68CC
Redirect Chain

https://id.rlcdn.com/709414.gif?gdpr=0&us_privacy=1-N-
https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e

0
214 B

61ms
60ms

Image
text/plain

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Wed, 13 Dec 2023 03:39:16 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 68CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=minute_media&gdpr=0&us_privacy=1-N-
https://cs.minutemedia-prebid.com/cs?aid=21479&id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
325 B

66ms
63ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21479&id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://eus.rubiconproject.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cs.minutemedia-prebid.com/cs?aid=21479&id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
Expires: 0

GET
H2

200

setuid
s2s.t13.io/ Frame 68CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-triple13&gdpr=0&us_privacy=1-N-
https://s2s.t13.io/setuid?bidder=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

86 B
441 B

185ms
60ms

Image
image/png

34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2s.t13.io/setuid?bidder=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: gzip
via: 1.1 google
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s2s.t13.io/setuid?bidder=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
Expires: 0

GET
H2

200

RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
sync.targeting.unrulymedia.com/csync/ Frame 68CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&gdpr=0&us_privacy=1-N-
https://sync.1rx.io/usersync/rubicon/LQ382S7J-12-IUP9?gdpr=0&us_privacy=1-N-
https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005

43 B
377 B

59ms
58ms

Image
image/gif

69.194.240.13
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 69.194.240.13 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-length: 43
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location: https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
cache-control: no-store, no-cache, must-revalidate
expires: 0
content-type: text/html

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 68CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=adyoulike&gdpr=0&us_privacy=1-N-
https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LQ382S7J-12-IUP9&name=RUBICON&gdpr=0&us_privacy=1-N-

49 B
383 B

87ms
86ms

Image
image/gif

52.14.231.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LQ382S7J-12-IUP9&name=RUBICON&gdpr=0&us_privacy=1-N-

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Server

52.14.231.222 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-14-231-222.us-east-2.compute.amazonaws.com

Software

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
via: kong/2.8.4
x-content-type-options: nosniff
x-kong-proxy-latency: 0
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
x-kong-upstream-latency: 4
cache-control: no-cache, no-store, must-revalidate
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LQ382S7J-12-IUP9&name=RUBICON&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Expires: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame B6BA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&gdpr_consent=undefined&gdpr=0&us_privacy=1-N-&khaos=LQ382S7J-12-IUP9
https://usersync.gumgum.com/usersync?b=mag&i=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-

35 B
250 B

64ms
63ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usersync.gumgum.com/usersync?b=mag&i=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
Expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 3FD1
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=minute_media&gdpr_consent=undefined&gdpr=0&us_privacy=1-N-&khaos=LQ382S7J-12-IUP9
https://cs.minutemedia-prebid.com/cs?aid=21479&id=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-

0
325 B

83ms
55ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21479&id=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://eus.rubiconproject.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cs.minutemedia-prebid.com/cs?aid=21479&id=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
Expires: 0

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame D2FC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=12776&gdpr_consent=undefined&gdpr=0&us_privacy=1-N-&khaos=LQ382S7J-12-IUP9
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-

0
295 B

93ms
91ms

Image
text/plain

3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=49&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dundertone.com%26id%3D%24%7BUIDENC%7D&gdpr=0
Protocol: H2
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: knwLGKgXBErjMzFMXDCvCNBeVuNx3mKydb6jIy5u60Z4jMo6abf-hQ==
x-cache: Miss from cloudfront

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
Expires: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 7B33
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr_consent=undefined&gdpr=0&us_privacy=1-N-&khaos=LQ382S7J-12-IUP9
https://cs.yellowblue.io/cs?aid=11590&id=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-

0
325 B

60ms
57ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11590&id=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://eus.rubiconproject.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cs.yellowblue.io/cs?aid=11590&id=LQ382S7J-12-IUP9&gdpr=0&gdpr_consent=undefined&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
Expires: 0

GET
BLOB 200
OK c45473e4-ffc4-4282-93c9-777799e74aa2
https://www.mercurynews.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.mercurynews.com/c45473e4-ffc4-4282-93c9-777799e74aa2
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H3 200 952.js Show response
cds.connatix.com/p/395790/ Frame 591F 76 KB
19 KB 52ms
52ms Script
application/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/395790/952.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe917cd13fd4d9f376fd1cfa6ee6d31d6c7a89a5e7129dc8511b6e2aec860fa1

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
x-amz-version-id: k4wMeyC81Bn1qFMx3zavPYGcRcP6LQES
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 12 Dec 2023 13:52:21 GMT
server: cloudflare
etag: W/"57846254bbd200f9201061ef4191f1e3"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 834b2dd20cbe8dc0-MIA
access-control-allow-headers: range
expires: Thu, 12 Dec 2024 03:39:16 GMT

GET
H3 200 402.js Show response
cds.connatix.com/p/395790/ Frame 591F 45 KB
10 KB 50ms
50ms Script
application/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/395790/402.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/mng-trib/b-34df212-ae6f9fe2.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a453ade31af0118629c4b7686eaae4e4248a1768b707e033d8d0f4eaf177c01a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
x-amz-version-id: xqBAj5YpHsWolkX2VPicnVMpyMahhcTp
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 12 Dec 2023 13:52:21 GMT
server: cloudflare
etag: W/"0bfdcab785ef6b9a586feebcbe69419f"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 834b2dd20cc28dc0-MIA
access-control-allow-headers: range
expires: Thu, 12 Dec 2024 03:39:16 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B6BA
Redirect Chain

https://match.deepintent.com/usersync/143?gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=1011864&nid=5528&put=di_0708913abe3144929801d

42 B
864 B

992ms
61ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=1011864&nid=5528&put=di_0708913abe3144929801d
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=1011864&nid=5528&put=di_0708913abe3144929801d
date: Wed, 13 Dec 2023 03:39:15 GMT
content-type: image/gif
server: b
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B6BA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=outbrain&gdpr=0&us_privacy=1-N-
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LQ382S7J-12-IUP9&obUid=&initiator=&gdpr=0&us_privacy=1-N-

0
287 B

283ms
61ms

Image
text/plain

64.202.112.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LQ382S7J-12-IUP9&obUid=&initiator=&gdpr=0&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 64.202.112.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:17 GMT
Cache-Control: no-cache
X-TraceId: 68c93b6b66bbd65d76d8562a1e5343f8
Content-Length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LQ382S7J-12-IUP9&obUid=&initiator=&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
Expires: 0

GET
H/1.1

200
OK

60909
i.liadm.com/s/ Frame B6BA
Redirect Chain

https://token.rubiconproject.com/token?pid=49096&gdpr=0&us_privacy=1-N-
https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

43 B
684 B

62ms
57ms

Image
image/gif

34.232.121.20
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

HTTP/1.1

Server

34.232.121.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-232-121-20.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:16 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 0
Content-Type: image/gif

Redirect headers

Location: https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B6BA
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=1&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=7430&nid=2238&put=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&expires=360&gdpr=0&gdpr_consent=

42 B
864 B

989ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7430&nid=2238&put=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&expires=360&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://pixel.rubiconproject.com/tap.php?v=7430&nid=2238&put=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&expires=360&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

cs
cs.yellowblue.io/ Frame B6BA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr=0&us_privacy=1-N-
https://cs.yellowblue.io/cs?aid=11590&id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
325 B

63ms
58ms

Image
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11590&id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://eus.rubiconproject.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cs.yellowblue.io/cs?aid=11590&id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 5e07703167439847c6c49a939083c0fd
Expires: 0

GET
H2

200

redirect
exchange.mediavine.com/usersync/ Frame B6BA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=17404&gdpr=0&us_privacy=1-N-
https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
186 B

239ms
54ms

Image
text/html

3.230.74.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 3.230.74.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-230-74-156.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
cache-control: private, no-cache
access-control-allow-credentials: true
content-encoding: gzip
vary: Origin, Accept-Encoding
content-type: text/html; charset=utf-8

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
Expires: 0

GET
H2

204

/
ssc-cms.33across.com/ps/ Frame B6BA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=33across&gdpr=0&us_privacy=1-N-
https://ssc-cms.33across.com/ps/?xi=1&xu=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
72 B

86ms
77ms

Image
text/plain

67.202.105.22
STEADFAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssc-cms.33across.com/ps/?xi=1&xu=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 67.202.105.22 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip22.67-202-105.static.steadfastdns.net
Software: 33XP020 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-33x-status: 2000208
date: Wed, 13 Dec 2023 03:39:16 GMT
server: 33XP020

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ssc-cms.33across.com/ps/?xi=1&xu=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d3682eda7e5cb79782b1d5475f50e8fc
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B6BA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&gdpr=0&us_privacy=1-N-
https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&gdpr=0&us_privacy=1-N-&_test=ZXknZAAGh0...
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=ZXknZAAGh0qAbABd&gdpr=0&us_privacy=1-N-&_test=ZXknZAAGh0qAbABd

42 B
864 B

368ms
60ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=ZXknZAAGh0qAbABd&gdpr=0&us_privacy=1-N-&_test=ZXknZAAGh0qAbABd
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by: cache-mia-kmia1760067-MIA
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1702438757.987195,VS0,VE0
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=ZXknZAAGh0qAbABd&gdpr=0&us_privacy=1-N-&_test=ZXknZAAGh0qAbABd
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B6BA
Redirect Chain

https://um.simpli.fi/rb_match?gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BCA2A12E8DA9409D83F5E5E2B0607EA3&expires=365

42 B
864 B

995ms
60ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BCA2A12E8DA9409D83F5E5E2B0607EA3&expires=365
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Wed, 13 Dec 2023 03:39:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BCA2A12E8DA9409D83F5E5E2B0607EA3&expires=365
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 12 Dec 2023 03:39:16 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B6BA
Redirect Chain

https://cm.adgrx.com/bridge?AG_SETCOOKIE&AG_PID=rubicon&gdpr=0&us_privacy=1-N-
https://cm.adgrx.com/bridge.gif?AG_PID=rubicon&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=144054&nid=4032&put=30ca6cd2-9969-11ee-976c-853635f810f4&expires=60

42 B
864 B

338ms
57ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=144054&nid=4032&put=30ca6cd2-9969-11ee-976c-853635f810f4&expires=60
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
server: Cowboy
content-type: image/gif
location: https://pixel.rubiconproject.com/tap.php?v=144054&nid=4032&put=30ca6cd2-9969-11ee-976c-853635f810f4&expires=60
access-control-allow-origin: *
p3p: CP="NOI OTC OTP OUR NOR"
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
x-realserver-nx: lga-delivery-5
content-length: 0
expires: Thu, 23 Sep 2004 17:42:04 GMT

GET
H2 204 rubicon
tr.blismedia.com/v1/api/sync/ Frame B6BA 0
173 B 168ms
61ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/rubicon?gdpr=0&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B6BA
Redirect Chain

https://token.rubiconproject.com/token?pid=2046&pt=n&a=1&gdpr=0&us_privacy=1-N-
https://rubicon-match.dotomi.com/match/bounce/current?networkId=12783&version=1&nuid=f0e1V-5xnt2tGQBpnynPN4XsnMZhMiGdLdsvN9R-tmQ&gdpr=0&us_privacy=1-N-
https://rubicon-match.dotomi.com/match/bounce/current?DotomiTest=7a00cadead852347&is_secure=true&networkId=12783&version=1&nuid=f0e1V-5xnt2tGQBpnynPN4XsnMZhMiGdLdsvN9R-tmQ&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAABnY_eJfHo7AMmvUzQAAAAAAA&expiration=1702525156&nuid=f0e1V-5xnt2tGQBpnynPN4XsnMZhMiGdLdsvN9R-tmQ&is_secure=true&us_privacy=1-N-&g...

42 B
864 B

345ms
60ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAABnY_eJfHo7AMmvUzQAAAAAAA&expiration=1702525156&nuid=f0e1V-5xnt2tGQBpnynPN4XsnMZhMiGdLdsvN9R-tmQ&is_secure=true&us_privacy=1-N-&gdpr=0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAABnY_eJfHo7AMmvUzQAAAAAAA&expiration=1702525156&nuid=f0e1V-5xnt2tGQBpnynPN4XsnMZhMiGdLdsvN9R-tmQ&is_secure=true&us_privacy=1-N-&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

sync
ads.yieldmo.com/ Frame B6BA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=yieldmo&gdpr=0&us_privacy=1-N-
https://ads.yieldmo.com/sync?pn_id=rc&id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

43 B
598 B

62ms
59ms

Image
image/gif

52.0.227.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/sync?pn_id=rc&id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.0.227.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-227-33.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ads.yieldmo.com/sync?pn_id=rc&id=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
Expires: 0

GET
H2

200

Rubicon
crb.kargo.com/api/v1/dsync/ Frame B6BA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=11864&gdpr=0&us_privacy=1-N-
https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

43 B
358 B

62ms
60ms

Image
image/gif

3.225.187.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 3.225.187.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-187-193.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
x-accel-expires: 0
vary: Origin
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
Expires: 0

GET
H2

200

setuid
prebid-s2s.media.net/ Frame B6BA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-medianet&gdpr=0&us_privacy=1-N-
https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

86 B
578 B

156ms
57ms

Image
image/png

34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: gzip
via: 1.1 google
server: envoy
content-type: image/png
access-control-allow-origin
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
alt-svc: clear
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 5e07703167439847c6c49a939083c0fd
Expires: 0

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame B6BA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=12776&gdpr=0&us_privacy=1-N-
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
292 B

92ms
90ms

Image
text/plain

3.161.213.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 3.161.213.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-114.yul62.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
via: 1.1 7476af8f062782a67347b5ad36d9410e.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
content-length: 0
x-amz-cf-id: Jtte6jS4TPY3DaLhC6pakDh9007zsr2c_hn0tv2czUcS6Ph-esTYSg==
x-cache: Miss from cloudfront

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d3682eda7e5cb79782b1d5475f50e8fc
Expires: 0

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 268 KB
85 KB 102ms
102ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NFD2QGD&l=MG2DL

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

696e3eb7f722dca9746491b3aa700d6ceff8e61e9fe859cf2d0e4229cb2379bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87312
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 13 Dec 2023 03:39:16 GMT

GET
H2 200 i.match
a.tribalfusion.com/ Frame 3FD1 43 B
463 B 117ms
108ms Image
image/gif 2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b10&u={rubicon_user_token}&redirect=https%3A//pixel.rubiconproject.com/tap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180&gdpr=0&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 834b2dd27e2d67b1-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=560687&ev=1&rurl=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D390200%26nid%3D5120%26put%3D%25%25VGUID%25%25&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=390200&nid=5120&put=RSLdR8HKiVWw&ev=1&us_privacy=1-N-&pid=560687&gdpr=0

42 B
864 B

1036ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=390200&nid=5120&put=RSLdR8HKiVWw&ev=1&us_privacy=1-N-&pid=560687&gdpr=0
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://pixel.rubiconproject.com/tap.php?v=390200&nid=5120&put=RSLdR8HKiVWw&ev=1&us_privacy=1-N-&pid=560687&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5c6449b65-77f82
expires: -1

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 3FD1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=smartadserver&gdpr=0&us_privacy=1-N-
https://rtb-csync.smartadserver.com/redir/?partnerid=104&partneruserid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

43 B
406 B

203ms
56ms

Image
image/gif

23.105.12.137
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=104&partneruserid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 23.105.12.137 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://rtb-csync.smartadserver.com/redir/?partnerid=104&partneruserid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08c627b67f10e75995ce6908d3f9f7b
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=7&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=101732&nid=3822&put=7311918780473014428&expires=730&gdpr=0

42 B
864 B

404ms
58ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=101732&nid=3822&put=7311918780473014428&expires=730&gdpr=0
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=101732&nid=3822&put=7311918780473014428&expires=730&gdpr=0
Date: Wed, 13 Dec 2023 03:39:16 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2

200

cookiesyncendpoint
sync.aniview.com/ Frame 3FD1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=17184&gdpr=0&us_privacy=1-N-
https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
253 B

385ms
60ms

Image
text/plain

96.46.186.182
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 96.46.186.182 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://b1sync.zemanta.com/usersync/rubicon/?gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=144598&nid=3992&expires=30&put=ma1cNti43N9YBSlW5Yod&gdpr=0&us_privacy=1-N-

42 B
864 B

1032ms
60ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=144598&nid=3992&expires=30&put=ma1cNti43N9YBSlW5Yod&gdpr=0&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:16 GMT
Content-Type: text/html; charset=utf-8
Location: https://pixel.rubiconproject.com/tap.php?v=144598&nid=3992&expires=30&put=ma1cNti43N9YBSlW5Yod&gdpr=0&us_privacy=1-N-
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 160
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://ums.acuityplatform.com/tum?umid=2&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=5672&nid=2082&put=864117689528&expires=30&us_privacy=1-N-

42 B
864 B

1031ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=5672&nid=2082&put=864117689528&expires=30&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 2fcb300b847bad3e7dd1184ec8a1c2f5
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Access-Control-Allow-Origin: *
Location: https://pixel.rubiconproject.com/tap.php?v=5672&nid=2082&put=864117689528&expires=30&us_privacy=1-N-
Content-Length: 0

GET
H2

204

/
csync.loopme.me/ Frame 3FD1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=loopme&gdpr=0&us_privacy=1-N-
https://csync.loopme.me/?partner_id=1441&vt=&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

0
155 B

451ms
152ms

Image
text/plain

35.214.224.182
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://csync.loopme.me/?partner_id=1441&vt=&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 35.214.224.182 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS: 182.224.214.35.bc.googleusercontent.com
Software: _ /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
server: _

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://csync.loopme.me/?partner_id=1441&vt=&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 82a6cabd8b3f0d2d2ae6e86e2699f0ba
Expires: 0

GET
H2

200

setuid
sync.ex.co/v1/ Frame 3FD1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=17136_2&gdpr=0&us_privacy=1-N-
https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

86 B
411 B

199ms
56ms

Image
image/png

34.207.35.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 34.207.35.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-207-35-169.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin
date: Wed, 13 Dec 2023 03:39:17 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://cms.quantserve.com/pixel/p-e4m3Yko6bFYVc.gif?idmatch=0&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=LXreqil43PU2K9j3fynE8S92iPI2eIqkeSstnFi1

42 B
864 B

1019ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=LXreqil43PU2K9j3fynE8S92iPI2eIqkeSstnFi1
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: c1df09169f58a071f2a391dff1b3307b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=LXreqil43PU2K9j3fynE8S92iPI2eIqkeSstnFi1
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

user.sync
match.sync.ad.cpe.dotomi.com/w/ Frame 3FD1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=epsilon&gdpr=0&us_privacy=1-N-
https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

43 B
449 B

390ms
59ms

Image
image/gif

2606:ae80:1450:16::2100
VALUECLICK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 2606:ae80:1450:16::2100 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
server: nginx
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
content-type: image/gif
cache-control: no-cache
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: cdd55fb02049ca8b9389527f6c1a1194
Expires: 0

GET
H2

200

usersync
e.serverbid.com/ Frame 3FD1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=24856&gdpr=0&us_privacy=1-N-
https://e.serverbid.com/usersync?cn=5529&ttt=1&dpui=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-

35 B
405 B

326ms
64ms

Image
image/gif

159.89.246.130
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e.serverbid.com/usersync?cn=5529&ttt=1&dpui=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: H2
Server: 159.89.246.130 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: gzip
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: https://eus.rubiconproject.com
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 58

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://e.serverbid.com/usersync?cn=5529&ttt=1&dpui=LQ382S7J-12-IUP9&gdpr=0&us_privacy=1-N-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1df09169f58a071f2a391dff1b3307b
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://rbp.mxptint.net/sn.ashx?gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R33645_10D9BCF50_BF647BAA&expires=60

42 B
864 B

61ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R33645_10D9BCF50_BF647BAA&expires=60
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R33645_10D9BCF50_BF647BAA&expires=60
Date: Wed, 13 Dec 2023 03:39:16 GMT
Cache-Control: private
Strict-Transport-Security: max-age=-385443557; includeSubDomains
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 227
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://match.adsby.bidtheatre.com/rubiconmatch?gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=17039&nid=2650&days=30&gdpr=0&gdpr_consent=&put=14b978ba-1d4d-48dc-a5b5-9e2b9c643836

42 B
864 B

59ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17039&nid=2650&days=30&gdpr=0&gdpr_consent=&put=14b978ba-1d4d-48dc-a5b5-9e2b9c643836
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: cdd55fb02049ca8b9389527f6c1a1194
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=17039&nid=2650&days=30&gdpr=0&gdpr_consent=&put=14b978ba-1d4d-48dc-a5b5-9e2b9c643836
Date: Wed, 13 Dec 2023 03:39:17 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=87&gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=333994&nid=4804&put=7364974048145578927&gdpr=0&gdpr_consent=

42 B
864 B

60ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=333994&nid=4804&put=7364974048145578927&gdpr=0&gdpr_consent=
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: af308bb17a856a105b8c87aaae7d7f8c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=333994&nid=4804&put=7364974048145578927&gdpr=0&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:16 GMT
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3FD1
Redirect Chain

https://rubiconcm.digitaleast.mobi/usersync/rubicon.gif?gdpr=0&us_privacy=1-N-
https://pixel.rubiconproject.com/tap.php?v=600424&nid=5498&put=ab98bc3c-a17d-4c61-af8f-a436009f4e93

42 B
864 B

60ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=600424&nid=5498&put=ab98bc3c-a17d-4c61-af8f-a436009f4e93
Requested by: Host: cs-tam.minutemedia-prebid.com
URL: https://cs-tam.minutemedia-prebid.com/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dminutemedia.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=600424&nid=5498&put=ab98bc3c-a17d-4c61-af8f-a436009f4e93
date: Wed, 13 Dec 2023 03:39:17 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 130
content-type: text/html; charset=utf-8

GET
H3 200 local_storage_frame17.min.html Show response
assets.bounceexchange.com/assets/bounce/ Frame C2B8 2 KB
970 B 36ms
36ms Document
text/html 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/local_storage_frame17.min.html
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f4fc114373da7e63fade04d84f7f1cfb5b31632246f33b10f3b7b275b85e6dd6

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: none
access-control-allow-origin: *
access-control-expose-headers: etag Content-Type
age: 77993
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=31536000
content-encoding: br
content-length: 938
content-type: text/html; charset=UTF-8
date: Tue, 12 Dec 2023 05:59:23 GMT
etag: W/"fc893948c3efc689b5b19d8a77958e23"
last-modified: Mon, 11 Dec 2023 15:58:02 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1702310281887143
x-goog-hash: crc32c=kX4cqg== md5=/Ik5SMPvxom1sZ2Kd5WOIw==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 2408
x-guploader-uploadid: ABPtcPpuqGx-_jt8_dAe1SVGXT1vv1I-DQCzghsEUZg73zZjUMyWvIQVe4gtCELDFpL9Qxnga0iJZ-mnpG5ecHpcue7Cew

GET
H3

200

sync Show response
capi.connatix.com/core/ Frame 591F
Redirect Chain

https://capi.connatix.com/core/sync
https://capi.connatix.com/core/sync?tier=1&final=true&UserScoringType=Enabled&ImplementationType=0

6 KB
2 KB

127ms
126ms

XHR
application/json

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/sync?tier=1&final=true&UserScoringType=Enabled&ImplementationType=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H3
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b4f97723bae0f62845e9aa5dc1aa8ce21d428c2c1c0c849f89327f4056eced0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2dd78a3467de-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Wed, 13 Dec 2023 03:39:16 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
location: https://capi.connatix.com:443/core/sync?tier=1&final=true&UserScoringType=Enabled&ImplementationType=0
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2dd30b7a3349-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 27
alt-svc: h3=":443"; ma=86400

POST
H2 200 story Show response
capi.connatix.com/core/ Frame 591F 338 KB
64 KB 197ms
196ms XHR
application/x-protobuf 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/story?v=395790&ab=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/395790/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26db860eec7d04f2b3ecde627f9191ece3cad15324cfc5a03d2792dc8a1062a1

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Wed, 13 Dec 2023 03:39:16 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2dd30b833349-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 180ms
63ms XHR
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 14 Dec 2023 03:39:17 GMT

POST
H2 204 event-stream Show response
k.p-n.io/ 0
126 B 202ms
56ms Fetch 34.239.34.19
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://k.p-n.io/event-stream
Requested by: Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.34.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-34-19.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Wed, 13 Dec 2023 03:39:17 GMT
access-control-allow-headers: *
access-control-max-age: 600
access-control-allow-methods: *

GET
H2 200 insights.bin Show response
ins.connatix.com/af67bb10-23cd-4bac-96fd-d924da24a1a0/f964b5f8-8486-4f8e-906b-3c6210e9f479/ Frame 591F 900 B
817 B 310ms
44ms XHR
application/x-protobuf 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/af67bb10-23cd-4bac-96fd-d924da24a1a0/f964b5f8-8486-4f8e-906b-3c6210e9f479/insights.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/395790/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0ea79d5d94d9c340c28307d8ed03208751f3d3cf7bbbc4324609f26d431e8b8

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 13 Dec 2023 01:47:35 GMT
server: cloudflare
etag: W/"23aa1b4d28636cb28ef1c47f907bd12a"
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: application/x-protobuf
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
vary: Accept-Encoding
cf-ray: 834b2ddaaca8336b-MIA
alt-svc: h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 03:39:17 GMT

GET
H2 200 blockedDomains_4.bin Show response
lit.connatix.com/08d7fb35-d571-4d24-887a-e9106ab7fdef/ Frame 591F 49 B
401 B 305ms
40ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lit.connatix.com/08d7fb35-d571-4d24-887a-e9106ab7fdef/blockedDomains_4.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/395790/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b35e8675e674d3f48b29c03964f7c3513f1fa2097338f3ea1f02e202d707f6c8

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 28 Aug 2023 20:07:52 GMT
server: cloudflare
etag: W/"c5522dc72aeac8fc876b4c26381579fc"
access-control-max-age: 86400
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 834b2ddaaddd0975-MIA
alt-svc: h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 03:39:17 GMT

GET
H2 200 insights.bin Show response
ins.connatix.com/40e69f49ccf9eab8402d48b7093556fc/ Frame 591F 576 B
410 B 309ms
45ms XHR
application/x-protobuf 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/40e69f49ccf9eab8402d48b7093556fc/insights.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/395790/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5bb51382de7ee7ef1ffa4fe4982826c027b0444d7cd127f1ef72c43e2f27e768

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 13 Dec 2023 01:36:08 GMT
server: cloudflare
etag: W/"ffe6e6dc6855be364ad4ad46a8b758a0"
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: application/x-protobuf
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
vary: Accept-Encoding
cf-ray: 834b2ddaacaa336b-MIA
alt-svc: h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 03:39:17 GMT

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DIndex%26api-tier%3D1%26uid%3D&gdpr=0
https://cks.connatix.com/cks?pid=17&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Index&api-tier=1&uid=ZXknYtLdjQGqeEc7lLJVmwAA%262891

139 B
164 B

100ms
41ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=17&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Index&api-tier=1&uid=ZXknYtLdjQGqeEc7lLJVmwAA%262891
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f323ad02770768f67d123d94486c37fe748131a0144582b044f387bf7a4ece8a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd363349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QnT1TOaznoEhN1QCIiqvvI9ACWpmtVgjBtF3zlI5kIcMkBj5RLJEicKNO29AAYUjZGZDZ0PgJVBjUe9IQv0n6pXreo41bgiZTqSc3rQ87ulLACPSoqXg0ANUN4%2FVbUXLwJ85g2jH"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cks.connatix.com/cks?pid=17&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Index&api-tier=1&uid=ZXknYtLdjQGqeEc7lLJVmwAA%262891
cache-control: no-cache
cf-ray: 834b2dd9bc4f0a02-MIA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D15%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DBeeswax%26api-tier%3D1%26uid%3D%7Buserid%7D&g...
https://cks.connatix.com/cks?pid=15&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Beeswax&api-tier=1&uid=AAAZ7E7K8k8AABRIfwE1Og&gdpr=0

132 B
153 B

137ms
78ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=15&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Beeswax&api-tier=1&uid=AAAZ7E7K8k8AABRIfwE1Og&gdpr=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cc18c36c904db9784ad17e0070bd6dccb992d233291e6692809ac543f7e930d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddd2d8a3349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=15&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Beeswax&api-tier=1&uid=AAAZ7E7K8k8AABRIfwE1Og&gdpr=0
Date: Wed, 13 Dec 2023 03:39:17 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1&gdpr=0
https://cks.connatix.com/cks?pid=19&uid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttl=1705030757

146 B
158 B

101ms
42ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=19&uid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttl=1705030757
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e94500371735dbf691ee6bf3b26196a76e2f8b6bbe0b367d0bce8fd50370bac5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd383349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=19&uid=af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c&ttl=1705030757
date: Wed, 13 Dec 2023 03:39:17 GMT
server: Kestrel
content-length: 213

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ad.turn.com/r/cs?pid=67&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D21%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DAmobee%26api-tier%3D1%26uid%3D%23USER_ID%23&gdpr=0
https://cks.connatix.com/cks?pid=21&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Amobee&api-tier=1&uid=3840816935748909997

129 B
146 B

102ms
43ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=21&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Amobee&api-tier=1&uid=3840816935748909997
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a67e01d2133d7fb41bad97a3f1560deb9e939bd689b40a1034cb66ea55151fe

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd393349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=21&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Amobee&api-tier=1&uid=3840816935748909997
pragma: no-cache
date: Wed, 13 Dec 2023 03:39:16 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D25%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DTripleLift%26api-tier%3D1%26uid%3D%24UID&gdpr=0
https://cks.connatix.com/cks?pid=25&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=TripleLift&api-tier=1&uid=228696289307885035225

131 B
148 B

102ms
45ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=25&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=TripleLift&api-tier=1&uid=228696289307885035225
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02a71ff10e1f6a77f591832e84515adc9f3efdcfacfc45db580c5810ba9af7c3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd403349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=25&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=TripleLift&api-tier=1&uid=228696289307885035225
date: Wed, 13 Dec 2023 03:39:17 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D6%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DAppNexus%26api-tier%3D1%26uid%3D%24UID=&gdpr=0
https://cks.connatix.com/cks?pid=6&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=AppNexus&api-tier=1&uid=2419896334597204579=&gdpr=0

129 B
147 B

101ms
44ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=6&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=AppNexus&api-tier=1&uid=2419896334597204579=&gdpr=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 543becbeef84b41c62bcb7153024d62a6bc55b3fc14ee4fe743033d1d168b697

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd3d3349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
an-x-request-uuid: 77223820-fd33-4125-9604-067656f90bc7
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cks.connatix.com/cks?pid=6&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=AppNexus&api-tier=1&uid=2419896334597204579=&gdpr=0
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cs Show response
cs.yellowblue.io/
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=connatix&gdpr=0
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5014331485
https://sync.1rx.io/usersync/tradedesk/af0e557b-a6d7-43c9-ae23-7cdedfe4ea4c
https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005?redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11599%26id%3DRX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
https://cs.yellowblue.io/cs?aid=11599&id=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005

0
324 B

58ms
58ms

Script
application/javascript

52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs.yellowblue.io/cs?aid=11599&id=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:18 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://www.mercurynews.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11599&id=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
date: Wed, 13 Dec 2023 03:39:18 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX72d673f81f564be7bc9e8afa79a8599a005
content-type: text/html

GET
H3

200

pixel Show response
capi.connatix.com/us/
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=6&gdpr=0&gdpr_consent=null
https://capi.connatix.com/us/pixel?puid=7364974048145578927&pId=40&gdpr=0&gdpr_consent=

82 B
373 B

89ms
88ms

Script
image/gif

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/us/pixel?puid=7364974048145578927&pId=40&gdpr=0&gdpr_consent=
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H3
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7f28e33d6a65a4269a7f4e327a177ead60fea39cb13129a35c4b24fef84f5af

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 834b2ddc9b9d67de-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://capi.connatix.com/us/pixel?puid=7364974048145578927&pId=40&gdpr=0&gdpr_consent=
date: Wed, 13 Dec 2023 03:39:17 GMT
content-length: 0

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame AA2E 0
0 66ms
66ms Document
text/plain 67.202.105.22
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0015a00002y7TWTAA2&ru=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D37%26UserId%3D9a4ece6145fd4058b729a6fb3a14aa97%26DemandPartnerName%3D_33Across%26tier%3D1%26DemandPartnerUserId%3D33XUSERID33X&gdpr=0
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.22 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip22.67-202-105.static.steadfastdns.net
Software: 33XP001 /
Resource Hash

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
server: 33XP001
x-33x-status: 2000208

GET
H2 200 user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 989E 16 KB
0 46ms
44ms Document
text/html 23.216.84.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156592&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D9a4ece6145fd4058b729a6fb3a14aa97%26DemandPartnerName%3DPubmatic%26tier%3D1%26DemandPartnerUserId%3D&gdpr=0
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.216.84.200 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-216-84-200.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=151602
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Wed, 13 Dec 2023 03:39:17 GMT
expires: Thu, 14 Dec 2023 21:45:59 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=561340&daaqp=1&ev=1&rurl=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D13%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DPulsePoint%26api-tier%3D1%26uid%3D%...
https://cks.connatix.com/cks?pid=13&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=PulsePoint&api-tier=1&uid=RSLdR8HKiVWw

122 B
143 B

103ms
47ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=13&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=PulsePoint&api-tier=1&uid=RSLdR8HKiVWw
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b75a9dc3143e5938461e8b164f32e05b75dddadaf4c2c9596480d2f56b65420

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd443349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://cks.connatix.com/cks?pid=13&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=PulsePoint&api-tier=1&uid=RSLdR8HKiVWw
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5c6449b65-77f82
expires: -1

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://i.ctnsnet.com/int/cm?exc=24&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D28%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DCrimtan%26api-tier%3D1%26uid%3D%5Buser_id%5D&gdpr=0
https://cks.connatix.com/cks?pid=28&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Crimtan&api-tier=1&uid=32ebc4b13a68465baa4ede9d0f6d2bcb

142 B
155 B

98ms
43ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=28&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Crimtan&api-tier=1&uid=32ebc4b13a68465baa4ede9d0f6d2bcb
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 139987972a461edf40c07355eb2cc6cc52df383e5e26ecfba644ff87013f3ff4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd343349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cks.connatix.com/cks?pid=28&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Crimtan&api-tier=1&uid=32ebc4b13a68465baa4ede9d0f6d2bcb
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D18%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DLoopMe%26api-tier%3D1%26uid%3D%7Bdevice_id%7D%26pubid%3D11186&gdpr=0
https://cks.connatix.com/cks?pid=18&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=LoopMe&api-tier=1&uid=ca70ea33-40c7-4667-aa07-f2e195e840a8&pubid=11186&gdpr=0

146 B
160 B

107ms
70ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=18&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=LoopMe&api-tier=1&uid=ca70ea33-40c7-4667-aa07-f2e195e840a8&pubid=11186&gdpr=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32ec3c581c5d05b1b5ec6e2a61274bb39417cf9b7b52d0d55046f4d3779294ef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddd2d873349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=18&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=LoopMe&api-tier=1&uid=ca70ea33-40c7-4667-aa07-f2e195e840a8&pubid=11186&gdpr=0
date: Wed, 13 Dec 2023 03:39:17 GMT
server: _
content-length: 0

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=105&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D9%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DCentro%26api-tier%3D1%26uid%3D%7BuserId...
https://cks.connatix.com/cks?pid=9&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Centro&api-tier=1&uid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0

159 B
168 B

102ms
46ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=9&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Centro&api-tier=1&uid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c73bb33fd4a5dd757295ae53760495a0c11c5e9ca90d6c3f3ef0c64f047c2f73

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd423349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cks.connatix.com/cks?pid=9&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Centro&api-tier=1&uid=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ads.yieldmo.com/pbsync?is=smartnews&redirectUri=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D39%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DYieldMo%26api-tier%3D1%26uid%3D%24UID&gdpr=0
https://cks.connatix.com/cks?pid=39&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=YieldMo&api-tier=1&uid=3zZLSppjjLpvLOyWeM8o&gdpr=0

130 B
152 B

101ms
46ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=39&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=YieldMo&api-tier=1&uid=3zZLSppjjLpvLOyWeM8o&gdpr=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 214255e073438d13dc040db818d800929750246c1be374ede4294c7f1ac1ddb3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd413349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cks.connatix.com/cks?pid=39&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=YieldMo&api-tier=1&uid=3zZLSppjjLpvLOyWeM8o&gdpr=0
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://connatix-supply-partners.tremorhub.com/sync?UISCX=9a4ece6145fd4058b729a6fb3a14aa97&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D5%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DTel...
https://cks.connatix.com/cks?pid=5&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Telaria&api-tier=1&uid=36eab2a810ce4b2bbbe97a9286432932

141 B
154 B

44ms
42ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=5&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Telaria&api-tier=1&uid=36eab2a810ce4b2bbbe97a9286432932
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4fbb2d1654ecd58cb4a4c9782f0e44aa93eff8c1404d73fb4eb3374850117fe9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddd5de53349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=5&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Telaria&api-tier=1&uid=36eab2a810ce4b2bbbe97a9286432932
date: Wed, 13 Dec 2023 03:39:17 GMT
server: nginx
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'

GET
H3

200

us Show response
capi.connatix.com/core/
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3672&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=a571c37c266940a3e482ae33355490&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0

0
231 B

108ms
107ms

Script
application/json

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=a571c37c266940a3e482ae33355490&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H3
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:18 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddd6cda67de-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:17 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=a571c37c266940a3e482ae33355490&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1702438757634055-1152

GET
H2 200 sync-iframe
cs-server-s2s.yellowblue.io/ Frame D566 621 B
0 62ms
61ms Document
text/html 52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr={gdpr}&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d9a4ece6145fd4058b729a6fb3a14aa97%26pname%3dIronSource%26api-tier%3d1%26uid%3d{partnerId}%26direct%3D1
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://www.mercurynews.com/
content-length: 621
content-type: text/html
date: Wed, 13 Dec 2023 03:39:17 GMT
server: istio-envoy
x-envoy-upstream-service-time: 3

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17331/ 39 KB
12 KB 67ms
66ms Script
text/javascript 108.138.128.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17331/sync.min.js?gdpr=0
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-28.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 60cafa05c97da06116c9164ae946addfe8812d8b104b0d4260cfd5e3884eeab7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:08:08 GMT
content-encoding: gzip
via: 1.1 e23983892b1c8fb4d47f943c0ee29028.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 16:12:35 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
age: 70270
etag: W/"24dc2bbea0cff17e96e133440043ddb8"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: W8eYhnNDH_k2W5wpgzPc9dTSx6fgq1V_C95dGdfPBLzBxsyj8JxKoQ==

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D1%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DSundaySky%26api-tier%3D1%26uid%3D%24%7Bssky_uuid%7D&gdpr=0
https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D1%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DSundaySky%26api-tier%3D1%26uid%3D%24%7Bssky_uuid%7D&gdpr...
https://cks.connatix.com/cks?pid=1&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=SundaySky&api-tier=1&uid=d6.b363aa2b50a44a06b4f0c629e4b5aef6

144 B
252 B

46ms
45ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=1&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=SundaySky&api-tier=1&uid=d6.b363aa2b50a44a06b4f0c629e4b5aef6
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1be4e84d61b2805a18266ffeec2519048870616aa7f49d3b98c4a2fc17a42d74

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:18 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2dddeec36ddf-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=1&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=SundaySky&api-tier=1&uid=d6.b363aa2b50a44a06b4f0c629e4b5aef6
date: Wed, 13 Dec 2023 03:39:18 GMT
x-content-type-options: nosniff
content-length: 0
x-frame-options: DENY

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.resetdigital.co/csync?pid=connatix&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D35%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DResetDigital%26api-tier%3D1%26uid%3D%24USER_I...
https://cks.connatix.com/cks?pid=35&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=ResetDigital&api-tier=1&uid=000001221E6850C8

126 B
145 B

81ms
81ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=35&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=ResetDigital&api-tier=1&uid=000001221E6850C8
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94991f06aa1ee0e1b6923afb8bb4c11e6909939dc1b90e1d878d42c0b2ba6317

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:18 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddd6e033349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=35&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=ResetDigital&api-tier=1&uid=000001221E6850C8
date: Wed, 13 Dec 2023 03:39:17 GMT
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 0
content-type: text/html

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D43%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DSonobi%26api-tier%3D1%26uid%3D%5BUID%5D&gdpr=0
https://cks.connatix.com/cks?pid=43&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Sonobi&api-tier=1&uid=d3a96dc9-f1df-41d5-a455-1cadd7e03e78

146 B
189 B

81ms
80ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=43&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Sonobi&api-tier=1&uid=d3a96dc9-f1df-41d5-a455-1cadd7e03e78
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c68a47266b81c1459bcc8299a35320c7925fbe19d81cf9129bdf440f4e5232fb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:18 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddd6e003349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:17 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-6-152
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cks.connatix.com/cks?pid=43&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Sonobi&api-tier=1&uid=d3a96dc9-f1df-41d5-a455-1cadd7e03e78
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=WIMKYDH0&gdpr=0&gdpr_consent=null&redirectUri=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d45%26ev%3d9a4ece6145fd4058b729a6fb3a14aa97%26pname%3...
https://cks.connatix.com/cks?pid=45&pname=Sharethrough&api-tier=1&uid=6708dfbe-c40c-4ab2-8984-61c0cd21b269&gdpr=0&gdpr_consent=null

146 B
159 B

104ms
49ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=45&pname=Sharethrough&api-tier=1&uid=6708dfbe-c40c-4ab2-8984-61c0cd21b269&gdpr=0&gdpr_consent=null
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08f2d24aacb59a96438bc916a80d44baed0ea3303d28896ef77df7697b27bb6e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddcfd473349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=45&pname=Sharethrough&api-tier=1&uid=6708dfbe-c40c-4ab2-8984-61c0cd21b269&gdpr=0&gdpr_consent=null
date: Wed, 13 Dec 2023 03:39:17 GMT
content-length: 0

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://xsync.iqzone.com/psync?t=s&e=376&cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D42%26ev%3D9a4ece6145fd4058b729a6fb3a14aa97%26pname%3DIqZone%26api-tier%3D1%26uid%3D%25USER_ID%25&gdpr=0
https://cks.connatix.com/cks?pid=42&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=IqZone&api-tier=1&uid=0cae3e60-3461-41d7-a987-d56f023c2f63

146 B
182 B

49ms
49ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=42&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=IqZone&api-tier=1&uid=0cae3e60-3461-41d7-a987-d56f023c2f63
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd07c5635233f7c1446bbe356fde45a45c3446d5bf081e9e7a04cb493995ff2a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:18 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddd9e6c3349-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

Date: Wed, 13 Dec 2023 03:39:17 GMT
Server: nginx
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS
Location: https://cks.connatix.com/cks?pid=42&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=IqZone&api-tier=1&uid=0cae3e60-3461-41d7-a987-d56f023c2f63
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=connatix&cspid=25&append=0&cb=%24%7BADELPHIC_CACHE_BUSTER%7D&redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D29%26ev%3D9a4ece6145fd4...
https://cks.connatix.com/cks?pid=29&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Adelphic&api-tier=1&uid=4c48eca0-1acd-49bc-ab52-5fd54049c3ec

146 B
290 B

54ms
54ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=29&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Adelphic&api-tier=1&uid=4c48eca0-1acd-49bc-ab52-5fd54049c3ec
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 360a78fe4022626cbb91ce5720b658f9f96323b18057886a34ecd206066de397

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:18 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2dddae886ddf-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

Location: https://cks.connatix.com/cks?pid=29&ev=9a4ece6145fd4058b729a6fb3a14aa97&pname=Adelphic&api-tier=1&uid=4c48eca0-1acd-49bc-ab52-5fd54049c3ec
Date: Wed, 13 Dec 2023 03:39:17 GMT
Connection: keep-alive
X-CI-RTID: 3d7d459d-18a1-4d30-bbb8-b01ddeb61720
Content-Length: 177
Content-Type: text/html; charset=utf-8

GET
H3

200

us
capi.connatix.com/core/ Frame 591F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=7cf4c6c4-b915-4cbd-83cc-28c0f662a829&ph=51e220cb-8c97-4a65-b047-91c933b79b78&r=https%3a%2f%2fcapi.connatix.com%2fcore%2fus%3fDemandPartner%3d8%26UserId%3d9a4ece61...
https://capi.connatix.com/core/us?DemandPartner=8&UserId=9a4ece6145fd4058b729a6fb3a14aa97&DemandPartnerName=OpenX&tier=1&DemandPartnerUserId=b6f2b37a-f959-4c00-b598-52adbba86516

0
231 B

86ms
85ms

Image
application/json

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/core/us?DemandPartner=8&UserId=9a4ece6145fd4058b729a6fb3a14aa97&DemandPartnerName=OpenX&tier=1&DemandPartnerUserId=b6f2b37a-f959-4c00-b598-52adbba86516
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H3
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 834b2ddb193067de-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://capi.connatix.com/core/us?DemandPartner=8&UserId=9a4ece6145fd4058b729a6fb3a14aa97&DemandPartnerName=OpenX&tier=1&DemandPartnerUserId=b6f2b37a-f959-4c00-b598-52adbba86516
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET cksync
cs.media.net/ Frame 591F 0
0

GET
H2 200 712202.gif
id.rlcdn.com/ Frame 591F 42 B
289 B 76ms
71ms Image
image/gif 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/712202.gif?cparams=9a4ece6145fd4058b729a6fb3a14aa97&gdpr=0
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET

report
capi.connatix.com/us/google/ Frame 591F
Redirect Chain

https://capi.connatix.com/us/google/pixel?tier=1&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=connatix&google_hm=OWE0ZWNlNjE0NWZkNDA1OGI3MjlhNmZiM2ExNGFhOTc&extra1=9a4ece6145fd4058b729a6fb3a14aa97&gdpr=0&google_redir=https%3a%2f%2fcapi.connatix....
https://capi.connatix.com/us/google/report?extra1=9a4ece6145fd4058b729a6fb3a14aa97&gdpr=0

0
0

GET 1a1c07e870d45c05896c3f9e9973d4b4.gif
sync.colossusssp.com/ Frame 591F 0
0

POST
H2 204 event-stream Show response
k.p-n.io/ 0
125 B 57ms
56ms Fetch 34.239.34.19
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://k.p-n.io/event-stream
Requested by: Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.34.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-34-19.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Wed, 13 Dec 2023 03:39:17 GMT
access-control-allow-headers: *
access-control-max-age: 600
access-control-allow-methods: *

GET

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame 591F
Redirect Chain

https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=372401555&pcid=9a4ece6145fd4058b729a6fb3a14aa97
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=372401555&pcid=9a4ece6145fd4058b729a6fb3a14aa97&ckls=true&ci=SefHJQM79d&nc=false&trid=1774226008

0
0

GET 81549
i.liadm.com/s/ Frame 591F 0
0

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 90 KB
29 KB 156ms
155ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ff58419af6043256398ec8b25c377918ab50a0fb95b33d8b79dc5629e4f9fcbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29489
x-xss-protection: 0
server: cafe
etag: 574 / 19704 / 31080056 / config-hash: 6487957748488688722
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 13 Dec 2023 03:39:17 GMT

GET ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 591F 0
0

GET f964b5f8-8486-4f8e-906b-3c6210e9f479.bin
vid.connatix.com/pid-eeee0146-0162-42be-802a-8ca2dfd49bc8/af67bb10-23cd-4bac-96fd-d924da24a1a0/ Frame 591F 0
0

GET cksync.php
contextual.media.net/ Frame D566 0
0

GET

generic
match.adsrvr.org/track/cmf/ Frame D566
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=typeaholdings
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5732721587

0
0

GET cks
cks.connatix.com/ Frame D566 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 7E02 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 7497 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 8FD8 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 0E73 0
0

POST iev
csm.va.us.criteo.net/ Frame 261D 0
0

GET connatix.omsdk.service-web.js
cds.connatix.com/p/plugins/ 0
0

GET
H/1.1 200
OK 1x1-pixel.png Show response
ams-depr-public.s3.amazonaws.com/ 68 B
423 B 198ms
70ms Fetch
image/png 52.216.58.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ams-depr-public.s3.amazonaws.com/1x1-pixel.png?fn=removeDomElement&publisher=www.mercurynews.com
Requested by: Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.4.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.58.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:19 GMT
Last-Modified: Tue, 27 Oct 2020 15:04:29 GMT
Server: AmazonS3
x-amz-request-id: AJFS5V48JVPFA2FM
ETag: "91e42db1c66c0b276abf6234dc50b2eb"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 68
x-amz-id-2: 1H19aVbJgNzrONJppCx2vDHT5Xg9BSI41RTVyTUAgw3bFHvYPuKT85jsQ/FsXjrAaunaoyVZu4c=

GET
H3 200 connatix.omsdk.session.client-1.4.2.js Show response
cds.connatix.com/p/plugins/ 60 KB
13 KB 48ms
48ms Script
application/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/plugins/connatix.omsdk.session.client-1.4.2.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a317045407e197c827358d312af14bc2abd9abe54ae1e8a75381a9e812dcc99

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Dec 2023 03:39:17 GMT
x-amz-version-id: A8F1_e4vwY1KEtRlHmqPnGHTZpMg8LMf
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 23 May 2023 10:40:37 GMT
server: cloudflare
etag: W/"604d09b454a403c6b255a788099368ac"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 834b2ddd5fb48dc0-MIA
access-control-allow-headers: range
expires: Thu, 12 Dec 2024 03:39:17 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
615 B 69ms
69ms XHR
application/json 54.209.94.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.94.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-94-68.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 6faec6c839cf9c2689725140884ea71acbc42eaaeff84304da3962f3405d1627

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:18 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache
x-server: 10.40.52.33
access-control-allow-credentials: true
content-length: 235
expires: 0

GET
H2 200 c Show response
ids.cdnwidget.com/ 448 B
786 B 177ms
93ms XHR
application/json 2600:1901:0:56e0::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ids.cdnwidget.com/c?cookieID=&deviceID=&iv=&v=&GCH1=&SCH1=&GCS1=132171159&GCS2=YjhmM2EwMmQtMjBkNy00ZmI5LWE0MTMtZTg2M2YxNGJkYjRiLmxvY2Fs&pe=false&wsid=3993&varID=&varData=undefined&log=%7B%22config%22%3A%7B%22gmEN%22%3Afalse%2C%22pixEN%22%3Atrue%7D%2C%22apikey%22%3A%222%5EHIykD%22%2C%22cjsversion%22%3A%221.5.9%22%2C%22wsid%22%3A3993%2C%22loadID%22%3A%22HYv4SL9CVUQuMA1%22%2C%22timing%22%3A%7B%22sessionStorageLoad%22%3A21%2C%22IDStageStart%22%3A21%2C%22obsReqview%22%3A247%2C%22obsReqpage%22%3A247%2C%22obsReqdata%22%3A284%2C%22netComplete%22%3A1913%2C%22IDStagePrefire%22%3A1913%7D%2C%22matches%22%3A%7B%22cookie%22%3Afalse%2C%22LS%22%3Afalse%7D%2C%22info%22%3A%7B%22isSpoofed%22%3Afalse%2C%22PM%22%3Afalse%2C%22DNT%22%3Afalse%2C%22deviceTimezone%22%3A-10%2C%22extensionID%22%3Anull%2C%22externalID%22%3Anull%2C%22agent%22%3A%7B%22device%22%3Anull%7D%2C%22firstLoad%22%3Atrue%7D%2C%22deviceid%22%3A%228806458002234290384%22%2C%22visitid%22%3A%221702438757606399%22%7D
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:56e0:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: 5046732cd1a50e70d5a27176c0905d7728ca189b840dc4ecea5886f2428e0cc4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:18 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 448

GET
H2 200 lookup Show response
pd.cdnwidget.com/ 49 B
169 B 190ms
90ms XHR
application/json 34.149.130.207
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://pd.cdnwidget.com/lookup?deviceID=2ZTGfQdGSUfsfFNte6zzyjIjg8J&bxwid=3993&bxdid=8806458002234290384&visitID=1702438757606399&enableUID2=false
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.130.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 207.130.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 771196c556ce9fe2914aa0d336cf0f11fbd579c7cdd52e8436b19e0fffdd783b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 13 Dec 2023 03:39:18 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49
content-type: application/json

POST
H3 204 collect
analytics.google.com/g/ 0
17 B 49ms
48ms Ping
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-LMTT1ZNHB1&gtm=45je3bt0v9105985080&_p=1702438749746&gcs=G1--&gcd=11l1l1l1l5&dma=0&tcfd=10000&cid=1754874842.1702438751&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEI&sid=1702438751&sct=1&seg=0&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&dt=Russian%20man%20flies%20from%20Denmark-LAX%20with%20no%20ticket%2C%20passport&_s=3&tfd=9597
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:18 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 init1.js Show response
api.bounceexchange.com/bounce/ 4 KB
2 KB 171ms
91ms Script
text/javascript 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bounceexchange.com/bounce/init1.js?wklzs=1004&wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgHYAGAJgBYBmADkIFZqA2a4zYALxCkeNYHcApgCMcqYAID6qACZRKATnmVMAJwE4QAGzhoMBHsQAe+Ur1UCYAlWpVRsAQ02bUCAOYS4KzVAAWwYAAOOACklACCwaQAYpFRfPEAdAC2VkieAJ4IAnw4CUggSbGmpJSxJmWksSpwOKL2CAC0SfUNMM7qrSoFDdICCM0qANYNoA2a9oYNfGI+DQggI6hIgwLADSAqDQH2tQEbwLGYAG6oosAS+SCDqAJQwYQAQpGkmgHPoRGkpH6BIaR04UidGiQOi8T4yVSGSyOTyBVBUWKpX+0XKKKiaOBUWqtVQLWajTaNxwnW6vX69iGIwW40m02As3mi2Wq3Wm22u32CPepAAws8VO9AV8efyvgJDEKwkQyORyMQ6HRGBRCPcACLYEBXG53R7PaQyKXPagsRjkBi8L6UcikeTEGjkUXPE7SKUyig0eiEHiMBTySJi0jSVxRVAqHDAAAyIHsrpF4WA1QEAeePkp0gAkmqjV9SAAtAAqAHEYAWM4Y4PgAJrpADSmkoSEoADUosBCPgYD5Bs2AMpOr4aGDALM5r6FksQaRF3sAVRgOBgUQAcuJGOx2OkwBmwK5qAApAdB1xGvVfU4ABTUJxANV5NVAKUF8bCMEcOGTfOep17cBESBUVAhCsKU300D8Uy+JB7CQHxJGAP5KnCd0qFoBhmGIdV1WOSkcAAbW2Vx4PSAIBAAXSgSk0CQTQBBw8M8KSEBpEcCQTlEIRaIosCP3o-DYzY04gK4qBEzgOijlwvDpBgAIJBUTiQGWCj5nONRY3STVtXgrUJHGFQiNgd86KEAIoFYVYzLwgAiKillo6yABprOg8RXA2dInOsnwCgEayyMwAIEMolRqNozUkgCZx6iQSQ2nsVw7CONM7DTFRpCkWR82LUty0rGt60bFs2w7Lse17TAh3OGQoGyydpznBcl1XAR103bddwPIA
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: 23e4480ae6550bf51e5cfb9e42800bc0e8d521709fa5d4a3c92c2f2044542061

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:18 GMT
content-encoding: gzip
via: 1.1 google
last-modified: Wed, 13 Dec 2023 03:39:18 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 25
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H/1.1 200
OK views Show response
prod-dfm-proxy-connext.azurewebsites.net/api/ 90 B
1 KB 425ms
424ms Fetch
application/json 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=95602427021ee80bb103979989774ba4&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Requested by: Host: cdn.pranmcpkx.com
URL: https://cdn.pranmcpkx.com/prod/dfm/t8y9347t.min.js?20231112
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash: bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9

Request headers

source-system: Plugin
site-code: DFM
autoqa: false
accept-language: en-US,en;q=0.9
settingskey: BANG,MERC
authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NzQ0Mzg3NTF9._lghYrKev7HNZAr1O0VrI7y0MVwy14nOfK4zc3KLoKk
ssid: a7624748f029bcda0dc446c0aa50c54a
environment: prod
config-code: BANGWPPRODWAB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: application/json
access-control-allow-origin: *
accept: application/json
attr: MERC
location: System
Referer: https://www.mercurynews.com/
version: Version: 2.8.6.1

Response headers

Expires: -1
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:18 GMT
Content-Encoding: gzip
X-Server-Time: 12/13/2023 3:39:19 AM
Server: Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET, ASP.NET
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Server-Time,Request-Context
Cache-Control: no-cache
Request-Context: appId=cid-v1:94ae5057-927d-4045-bf63-1b3776adbf9e

OPTIONS
H/1.1 200
OK views
prod-dfm-proxy-connext.azurewebsites.net/api/ Frame 0
0 283ms
64ms Preflight 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=95602427021ee80bb103979989774ba4&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method: GET
Origin: https://www.mercurynews.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Access-Control-Allow-Headers: access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Wed, 13 Dec 2023 03:39:18 GMT
X-Powered-By: ASP.NET

POST
H2 200 OpportunityServlet
ch-vid-events.taboola.com/ 1 B
123 B 143ms
142ms Ping
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ch-vid-events.taboola.com/OpportunityServlet
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/33_6_6/infra/cmTagRECO_REEL_WIDGET.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.mercurynews.com
date: Wed, 13 Dec 2023 03:39:18 GMT
access-control-allow-credentials: true
server: nginx
content-length: 1

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 32E0 16 KB
6 KB 88ms
87ms Document
text/html 23.216.84.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.216.84.200 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-216-84-200.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://www.mercurynews.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=151601
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Wed, 13 Dec 2023 03:39:18 GMT
expires: Thu, 14 Dec 2023 21:45:59 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 contextual Show response
contextual-analytics.wunderkind.co/api/ 140 B
193 B 183ms
91ms XHR
application/json 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://contextual-analytics.wunderkind.co/api/contextual?url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&website_id=3993
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: 54b07a5c05e9ede0af6bd8b70eb3083d6bfd5a555eecce6657e586f36488c25f

Request headers

Accept: */*
Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: https://www.mercurynews.com
date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140
content-type: application/json

GET
H2 200 2ZTGfQdGSUfsfFNte6zzyjIjg8J Show response
dfp.bouncex.net/pub/v2/segment/ 2 B
193 B 148ms
66ms XHR
application/json 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dfp.bouncex.net/pub/v2/segment/2ZTGfQdGSUfsfFNte6zzyjIjg8J
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Accept: */*
Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 google
content-type: application/json
access-control-allow-origin: https://www.mercurynews.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

GET
H2 200 visit
events.bouncex.net/track.gif/ 42 B
97 B 74ms
70ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/visit?wklz=G4SwziAuBcCuYFMBOBDA5ggdpAvAWQHsAvEAG1JQFIAmAMQFYA6ABhuYAoB1ETAEwIDuYNgDkAKmwCMzFpQDMAITbdMANgAs8pdWYAPDQEo2AQQAOp0gk4IARgGkoNBnIDsjOarbs7ACTF4AGRoAYTZSEABrBDYAcQQAYwiCIx1ggAskAgBbaLpJHRZGVWYAThLGF0k2AGUUADMUJBAneld3VQAyUAgYJAQ65D6kHC7wKGgKPh40U3QEWCRSHDTISFNhalbjGno6HboBQ8YcpHiFgE9MBCFGeOz92h1qOQf81+oHpHgIFEwAWiyvz+dXCCDAwMyWT+vCwgKQET+kAIfwouj+AigaT+mGRkBAiQQkD+BCQf1mYDAphJkAeox60D6YAIpFgeIImF0OEkxWYdPGjOZrJA7POXJ0vO64zOYCRWWAjRAKBsljAOEoLm01FmGAA+pBzqZch85NtqNRGnj4pYaB9qKEzVkCLwUKQdZLlUb5KbqA1SIgbSEbSheG6xh6AyabZAvp67TbeHVTDqkMqCIkI96cZBkwhg+cAy4ACJ8mB3AgREAINUa+MgXgZm0ADkbzA09BbzDNcnU1BKzDkjc0ZsDZtA9eHJskLk76gHLnbjckcm7LhH1F4aFoICQMoCBGDGejsFy9uoaUavAAkoWG2bqAAtMQxOpiS+6WCSACa5zspDk8TkAA1WhIEqOo0giQDqgDOMzSZOpIGvW8zUfZ8AEVeBiaoAFU6jAOpaBESAEFUIgiHOAArS8KLQRsACkYNPDcGxrM1wAABT6UACHgYJ4FlZAM19f1YOocBqlgGwwHiJobEEidjGEk8bXiFB4jSBA9Q2Y1jCnGc53bVQW3VG9RLqYAaQUvTqFnRt50bNcUAIDNWFE0hTGQlY1g2LYHgeQ4BGOZAziQS5rjAW57k2OgnheaLaDeeLEt2WgvgpRV-kBf4QUrcE6khaFYUaBEkRRFA0QxSAsRxRF8SiIkSTJFAKSpJBLJSxig20r1XNPYBTGADMqlE8cdPjTqzSQZCJuoeILKG6cbIMhzRIgUavT+YbTzQGSM1XUSshctdSHmqzFts+y10GhT1SUIsTI6eBkDmbBoBsTIhGQHB0khBBHsQVAMFe4BkAgdkxRkGRijKCpJH+56gZgCwUEgOoSSyHAVH4IQpF5J7AawGAYVAeJCQNKsYTACIkVMDppQEpBoHPaT2RBtqEF4HBeQwAhoDuWBsFCu4YRwbDqg6Hm+Z4wXzmFhA5FF6pjAlhBef5mXMBQHJRcwKAOZqSAUbBFXeb6NBhUwHBaACE2GQQc32U17XaFIEk6xQW34igUU8EVLIQFtqkZRdOWcGXSQShcT32TxK5sFDkRlcdEXeQEWwegQOsw7KOQSyz6yLoXJcVw6Yn8Uzznm1bdR22YTtnh7PsB3UDptQQUBrnzjpEAAR2PTBSaz3krUrbA8RyYOslMLlzuWxtijp0FsBQUwQDZsHLcNtBc7L0mcF4Vu5j1cmcAtfFLG7njTirNObA6F7cHxy+EJ1LOHyfOoMKw3D8MI4jSPIlRGi9EOjniQCGN+qEXxvg-N+X8-4gIgTAhBKCQA
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:18 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 pageview
events.bouncex.net/track.gif/ 42 B
165 B 71ms
68ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/pageview?wklz=A4Qw5gpgbglhDuAuArgJwDYF4AWAXXwAzgKQDMAgsQEwBi1N8jAdALYSoDGaAngHYKEmHAPYt6VAAxVS9AIxU5C2qmSFCMELwC0LTVoBm6OIQOpRWgCYReu1AGstuYVvQgAHlvgxc2Lb2e4MBx2ELhawqhaoGrAEbj0AGSgkLAIiFyETixQIKgaAEboEISYxADsAELUVMkQAPq43MAQ1WSUVFS5gRxFrVQAwtUswhYg6HWw6oUtHW3V+mOEM0qDHSAWEzBTvbMU1bgqy9SrVBb6wHWohcLBrXsd-riXEOvcrWUAIkng0HBIIsI7MYYAAvCCYAAsADYyt8Un90pphLwgmNMHDfmkAUD6k5hHVXKhIJgFuglhjUv9hIC4A0muDSMAyRSEdjaeowZhSGUobIEiIWMB0oLMBJ+aIhbgOPpMHyBULVMBZeLBYgwMAlXKJYQUIQhZk8rwwLKtAA5LQJYZWUUJeAQfLqXAQGAWLkATjdpASk28LtlZSkENIAA4ygBWYPB2SkUgQ2FWWAcZ2uyMSKEQiMSKTSCFUN0SEMQlkIP18pYAR2Q1iTpf5Rms+BgbEyIBFsgDVCDoYjwahULrcF4uBAwBgUHY6mRmGHYC9CaC4IsGLpzUwXSCRQShGEaCTmDt+QSPyHmFU7C3wn0Tz9VAAWgAVADi+gAihZHwBlACq+kI+hoppOlCIIgtwABWACSYFgMGABSCTYLkGw3g+z73hBbjILIACa3AANLoKQHCkAAajQuBlLI+jYHYJEfkAA
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:18 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2

200

sync
ssp.behave.com/
Redirect Chain

https://ssp.behave.com/push_sync
https://ssp.behave.com/ul_cb/push_sync
https://x.bidswitch.net/sync?ssp=bouncex
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=bouncex&ssp_user_id=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-VYif7PpE2pk_KhwOMDT8f_7sGfPQOz0wS1Vf5Q--~A&expires=5&ssp=bouncex
https://ssp.behave.com/sync?tp_id=2&tp_uid=5a3f1a6b-829a-444b-9541-a9778d3d14bc

43 B
206 B

64ms
63ms

Image
image/gif

35.207.48.122
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssp.behave.com/sync?tp_id=2&tp_uid=5a3f1a6b-829a-444b-9541-a9778d3d14bc
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 35.207.48.122 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 122.48.207.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
content-type: image/gif

Redirect headers

Location: //ssp.behave.com/sync?tp_id=2&tp_uid=5a3f1a6b-829a-444b-9541-a9778d3d14bc
Date: Wed, 13 Dec 2023 03:39:19 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

204
No Content

62b6430e25b8b4664ae1c16e6d571926.gif
cs.admanmedia.com/
Redirect Chain

https://cs.admanmedia.com/ff062a454b79198e17a2ec718ec55e04.gif?puid=3993-8806458002234290384&gdpr=0&gdpr_consent=&ccpa=1-N-
https://us.ck-ie.com/act639.gif?gdpr=0&gdpr_consent=[GDPR_Consent]&us_privacy=1-N-&coppa=[COPPA]&redir=https%3A%2F%2Fcs.admanmedia.com%2F62b6430e25b8b4664ae1c16e6d571926.gif%3Fpuid%3D%7B%24PARTNER_...
https://cs.admanmedia.com/62b6430e25b8b4664ae1c16e6d571926.gif?puid=fffbbe25719525c50c413821fa20bda416003f6eafa1fc1fe5c3a5ad3731e53d&redir=[RED]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&ccpa=[CCPA]&...

0
533 B

209ms
68ms

Image
text/plain

80.77.87.161
NATCOWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.admanmedia.com/62b6430e25b8b4664ae1c16e6d571926.gif?puid=fffbbe25719525c50c413821fa20bda416003f6eafa1fc1fe5c3a5ad3731e53d&redir=[RED]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&ccpa=[CCPA]&coppa=[COPPA]
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Server: 80.77.87.161 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:19 GMT
Server: nginx
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:19 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://cs.admanmedia.com/62b6430e25b8b4664ae1c16e6d571926.gif?puid=fffbbe25719525c50c413821fa20bda416003f6eafa1fc1fe5c3a5ad3731e53d&redir=[RED]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&ccpa=[CCPA]&coppa=[COPPA]
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

POST
H2 200 OpportunityServlet
ch-vid-events.taboola.com/ 1 B
123 B 73ms
72ms Ping
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ch-vid-events.taboola.com/OpportunityServlet
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/33_6_6/infra/cmTagFEED_MANAGER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.mercurynews.com
date: Wed, 13 Dec 2023 03:39:18 GMT
access-control-allow-credentials: true
server: nginx
content-length: 1

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 32E0 5 KB
6 KB 58ms
56ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=48439369&p=156512&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 49fd5fa4d828b6010ec850728cff1611cea702aabb06d305986ff0e33e055e23

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Wed, 13 Dec 2023 03:39:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

hash.gif
pix.cdnwidget.com/
Redirect Chain

https://pix.cdnwidget.com/redirect?CID=2ZTGfTIxu1YyKl3c3VFt71fhkVS&DID=2ZTGfQdGSUfsfFNte6zzyjIjg8J&v=&iv=&deviceid=8806458002234290384&visitid=1702438758813347&wsid=3993&apikey=2^HIykD
https://pippio.com/api/sync?pid=5749
https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none

68 B
626 B

73ms
72ms

Image
image/png

34.149.254.212
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Server: 34.149.254.212 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 212.254.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 id_sync
events.bouncex.net/track.gif/ 42 B
95 B 70ms
69ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/id_sync?id_sync:id_type=sid&id_sync:id_source=graph&soft_id=2ZTGfQdGSUfsfFNte6zzyjIjg8J&source=web&agent=cjs&deviceid=8806458002234290384&visitid=1702438758813347&websiteid=3993&pageviewid=1&sequenceid=1
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 3E80
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFBWjdFN0s4azhBQUJSSWZ3RTFPZw&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Csyn%2Cpp%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Csyn%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AAAZ7E7K8k8AABRIfwE1Og&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsyn%252Cpp%252C...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=syn%2Cpp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=7364974048145578927&gdpr=0&gdpr_consent=
https://sync.technoratimedia.com/services?uid=AAAZ7E7K8k8AABRIfwE1Og&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D7364974048145578927%26gdpr%3D0%26gdpr_cons...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=7364974048145578927&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=3
https://bh.contextweb.com/bh/rtset?ev=AAAZ7E7K8k8AABRIfwE1Og&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D7364974048145578927%26gdpr%3D0%26bee_sync_pa...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=7364974048145578927&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AAAZ7E7K8k8AABRIfwE1O...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAAZ7E7K8k8AABRIfwE1Og&gdpr=0

42 B
200 B

64ms
64ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAAZ7E7K8k8AABRIfwE1Og&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Wed, 13 Dec 2023 03:39:20 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAAZ7E7K8k8AABRIfwE1Og&gdpr=0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame 94CE
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2419896334597204579&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
446 B

59ms
55ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:18 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame 1597
Redirect Chain

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_0708913abe3144929801d
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
388 B

59ms
58ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2 200 b9pj45k4 Show response
sync-tm.everesttech.net/upi/pid/ Frame 1D81 85 B
259 B 58ms
58ms Document
image/png 151.101.130.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Wed, 13 Dec 2023 03:39:19 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760067-MIA
x-timer: S1702438759.089239,VS0,VE26

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame 19C6
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=9c06ZPHPODvunDw5p54gP_fBbDzuz25qoZw4j38X
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
388 B

59ms
58ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame AD30
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://rtb.adstanding.com/ssp/bidswitch/cookie?bidswitch_ssp_id=pubmatic&bidswitch_custom_parameter=5a3f1a6b-829a-444b-9541-a9778d3d14bc
https://x.bidswitch.net/sync?dsp_id=317&user_id=7a14f5d5dae174e8b8e2478e8fa2bc43&expires=30&ssp=pubmatic&bsw_param=5a3f1a6b-829a-444b-9541-a9778d3d14bc
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
185 B

57ms
57ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Wed, 13 Dec 2023 03:39:19 GMT
Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=5a3f1a6b-829a-444b-9541-a9778d3d14bc&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Server: nginx

GET
H3 200 i.match Show response
a.tribalfusion.com/ Frame 4B78 43 B
675 B 116ms
107ms Document
image/gif 2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 834b2de468fb5c76-MIA
content-length: 43
content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:19 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame 8AA7
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=-tBDgfwlV_hvwp42xPpc4iaEdkY&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
388 B

58ms
56ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame 35E7
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=30ca6cd2-9969-11ee-976c-853635f810f4
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
388 B

61ms
58ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:19 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 2

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame BEE1
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:LN3ozJPT1Rdg5F5&gdpr=0&gdpr_consent=

42 B
300 B

58ms
57ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:LN3ozJPT1Rdg5F5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Wed, 13 Dec 2023 03:39:18 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:LN3ozJPT1Rdg5F5&gdpr=0&gdpr_consent=
Pragma: no-cache
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-03c1db2195cf6cc2b@us-east-1d@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 2FEB
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=824a78bb-85bb-4ab8-8a0e-a36bc53e9a3a&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837

42 B
491 B

57ms
57ms

Document
image/gif

3.213.9.240
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.9.240 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-9-240.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:19 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:18 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame 63C1
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970033170794683279
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
388 B

57ms
56ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame 4534
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
411 B

58ms
57ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:19 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame C219
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU1f2b7076087d4d6cb37ccbae52657195

42 B
358 B

65ms
65ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU1f2b7076087d4d6cb37ccbae52657195
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU1f2b7076087d4d6cb37ccbae52657195
pragma: no-cache
server: Tengine

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 7C01 0
0

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame 536C
Redirect Chain

https://ums.acuityplatform.com/tum?umid=6
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=864117689528
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
388 B

58ms
56ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1282
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
74 B

56ms
56ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame 0506
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:9fb36579-2761-4500-b798-f064b1795d0b&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
391 B

57ms
56ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 0

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 708C
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=RxrUaQavB5eg1GpDZyd5ZQ

42 B
279 B

65ms
63ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=RxrUaQavB5eg1GpDZyd5ZQ
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:20 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cache-control: no-store
content-length: 153
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=RxrUaQavB5eg1GpDZyd5ZQ
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame 3FE6 43 B
304 B 84ms
73ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Wed, 13 Dec 2023 03:39:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C281
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=78233980
https://sync.1rx.io/usersync3/mediamathtest/1508/9fb36579-2761-4500-b798-f064b1795d0b?zcc=0&sspret=1
https://sync.targeting.unrulymedia.com/csync/RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005

42 B
273 B

56ms
56ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-type: text/html
date: Wed, 13 Dec 2023 03:39:19 GMT
etag: RX72d673f81f564be7bc9e8afa79a8599a005
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-72d673f8-1f56-4be7-bc9e-8afa79a8599a-005
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame EF49 43 B
279 B 674ms
170ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Wed, 13 Dec 2023 03:39:19 GMT
Vary: Accept-Encoding
X-adserver-worker: komodo-ae0a9e3f41c6@version_1.578v2
X-core-time: 1ms
X-server-arch: v2

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame 41A9 0
0 454ms
147ms Document
text/plain 23.88.86.2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.88.86.2 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.2.86.88.23.clients.your-server.de

Software

nginx/1.23.1 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Date: Wed, 13 Dec 2023 03:39:19 GMT
Server: nginx/1.23.1
Strict-Transport-Security: max-age=15768000

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame D1C5
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7557251591772898323&uid=Q755725159177289...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7557251591772898323

42 B
95 B

57ms
56ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7557251591772898323
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 13 Dec 2023 03:39:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: max-age=25832
Connection: keep-alive
Content-Length: 154
Content-Type: text/html
Date: Wed, 13 Dec 2023 03:39:19 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7557251591772898323
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: Apache/2.4.6 (CentOS)
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

GET
H2

200

4518 Show response
prebid.a-mo.net/cchain/4/ Frame D92A
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:BCA2A12E8DA9409D83F5E5E2B0607EA3&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...

722 B
388 B

59ms
57ms

Document
text/html

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 277a994ef12a2323388d93620a54984a3c7791b2f382d16dafb6e819cf5725f6

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 356
content-type: text/html; charset=utf-8
date: Wed, 13 Dec 2023 03:39:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 2

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 13 Dec 2023 03:39:19 GMT
location: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

insync
thrtle.com/ Frame 32E0
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&vxii_pid=12&vxii_pid1=10067&vxii_rcid=84e9ec14-c499-4255-89ec-ccf5a825aa30

43 B
295 B

60ms
60ms

Image
image/gif

52.71.16.59
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&vxii_pid=12&vxii_pid1=10067&vxii_rcid=84e9ec14-c499-4255-89ec-ccf5a825aa30
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Server: 52.71.16.59 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-16-59.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Wed, 13 Dec 2023 03:39:19 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&vxii_pid=12&vxii_pid1=10067&vxii_rcid=84e9ec14-c499-4255-89ec-ccf5a825aa30
date: Wed, 13 Dec 2023 03:39:19 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame 32E0 43 B
61 B 68ms
62ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 Martin
crb.kargo.com/api/v1/dsync/ Frame 32E0 43 B
358 B 67ms
57ms Image
image/gif 3.225.187.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.187.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-187-193.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:19 GMT
x-accel-expires: 0
vary: Origin
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame 32E0 0
425 B 299ms
57ms Image
text/plain 52.72.189.162
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.189.162 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-189-162.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Connection: keep-alive
Date: Wed, 13 Dec 2023 03:39:19 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 32E0
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33645_10D9BCF50_BF647BAA&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

68ms
68ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512

Protocol

HTTP/1.1

Server

38.98.69.175 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-385443559; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Expires: -1
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:18 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=-385443559; includeSubDomains
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Tue, 12 Dec 2023 18:04:09 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 32E0 0
285 B 192ms
58ms Image
text/plain 54.198.64.103
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.64.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-64-103.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 32E0
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=026824ab-f441-4f43-9dd8-23ebff6604fe-6579275e-5553&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...
https://ap.lijit.com/pixel?&gdpr=0&us_privacy=1---&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79c-66a4-478...
https://prebid.a-mo.net/cchain/5/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=sovrn&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0y...
https://rtb.openx.net/sync/prebid?&gdpr=0&us_privacy=1---&r=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F7%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79c-66a4-...
https://prebid.a-mo.net/cchain/7/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=openx&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0y...
https://cs.minutemedia-prebid.com/cs?aid=21492&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0

0
321 B

59ms
58ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21492&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:21 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://ads.pubmatic.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21492&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0
date: Wed, 13 Dec 2023 03:39:20 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 32E0
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3840816935748909997&gdpr=0&gdpr_consent=&us_privacy=1-N-
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=1-N-
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...
https://ap.lijit.com/pixel?&gdpr=0&us_privacy=1---&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79c-66a4-478...
https://prebid.a-mo.net/cchain/5/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=sovrn&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0y...
https://rtb.openx.net/sync/prebid?&gdpr=0&us_privacy=1---&r=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F7%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79c-66a4-...
https://prebid.a-mo.net/cchain/7/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=openx&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0y...
https://cs.minutemedia-prebid.com/cs?aid=21492&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0

0
321 B

62ms
61ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21492&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:21 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://ads.pubmatic.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21492&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0
date: Wed, 13 Dec 2023 03:39:20 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 32E0
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=2531413247159590299
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79...
https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZ...
https://ap.lijit.com/pixel?&gdpr=0&us_privacy=1---&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79c-66a4-478...
https://prebid.a-mo.net/cchain/5/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=sovrn&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0y...
https://rtb.openx.net/sync/prebid?&gdpr=0&us_privacy=1---&r=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F7%2F4518%3Fgpp%3D%26gdpr_consent%3D%26gdpr%3D0%26gpp_sid%3D%26us_privacy%3D%26A%3D7b36d79c-66a4-...
https://prebid.a-mo.net/cchain/7/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=openx&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0y...
https://cs.minutemedia-prebid.com/cs?aid=21492&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0

0
321 B

61ms
60ms

Image
application/javascript

34.197.219.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21492&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Server: 34.197.219.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-219-74.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:21 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://ads.pubmatic.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21492&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0
date: Wed, 13 Dec 2023 03:39:21 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
content-length: 0

GET
H2 200 index.js Show response
cdn.pranmcpkx.com/ 7 KB
2 KB 33ms
32ms Script
text/javascript 2606:2800:11f:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pranmcpkx.com/index.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mic/9B0A) /
Resource Hash: 6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 13 Dec 2023 03:39:19 GMT
content-encoding: gzip
content-md5: nynBpfvYghYqzIzsvfssRw==
age: 575611
x-cache: HIT
content-length: 2382
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jun 2022 17:08:13 GMT
server: ECAcc (mic/9B0A)
etag: 0x8DA5083F65AD9E0
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
x-ms-request-id: 2722cede-901e-0033-6239-28a815000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19

GET
H/1.1 200
OK ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 631 B
1 KB 242ms
125ms Image
image/jpeg 52.217.92.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.92.12 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Wed, 13 Dec 2023 03:39:20 GMT
Last-Modified: Tue, 15 Oct 2019 13:44:16 GMT
Server: AmazonS3
x-amz-request-id: JV2JX5FMKDJ3P92W
ETag: "ef2cc7f55b7ab677b023e36033e26471"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 631
x-amz-id-2: oowKNLBEAmur1ZYdtR6V2rPTj/uxB8X9FqHodJ1HFxe+fV3ZtIrXkUg1cHtINlexD3WTjDvE4Bs=
x-amz-meta-s3b-last-modified: 20191015T134358Z

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 94CE 13 KB
5 KB 164ms
52ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de6ea91db19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 1597 13 KB
5 KB 154ms
44ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de6ea8fdb19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 536C 13 KB
5 KB 138ms
43ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de6ea8cdb19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 8AA7 13 KB
5 KB 156ms
63ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de71ad4db19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 4534 13 KB
5 KB 138ms
47ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de6ea8bdb19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 19C6 13 KB
6 KB 130ms
40ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de6ea87db19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 63C1 13 KB
5 KB 124ms
45ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de6ea8adb19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame D92A 13 KB
5 KB 128ms
72ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de71ad5db19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 35E7 13 KB
5 KB 89ms
42ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de6ea94db19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 0506 13 KB
5 KB 88ms
46ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/cchain/4/4518?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=&A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 2e9033da1cf7b64ac622ab535b39a266.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de6ea93db19-MIA
x-amz-cf-id: NwMJOZzNv4kXS1ll3digvybdRkXclpp2eAQTYKA9_Kxddhq6WC6skw==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H3 200 reloadCampaigns.js Show response
api.bounceexchange.com/bounce/ 3 KB
1 KB 76ms
75ms Script
text/javascript 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bounceexchange.com/bounce/reloadCampaigns.js?wklzs=1306&wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgHYAGAJgBYBmADkIFYBOQ06zYALxCgDZjjMA7gFMARjlTAhAfVQATKJQYNKmAE5CcIADZw0GAr2IAPfKT5qhMIavWqo2AIZatqBAHMpcVVqgALYMAADjgApJQAgiGkAGJR0QIJAHQAttZIXgCeCEICOIlIIMlxZqSUcablpHGqcDjiDggAtMkNjTAuGm2qhY2yQggtqgDWjaCNWg5GjQISvo0IIKOoSENCwI0gqo2BDnWBm8BxmABuqOLAUgUgQ6hCUCGEAEJRpFqBL2GRpKT+QaGkdAiUToMWBMQSAhSaUy2Vy+UKYOiJTKAJiFVR0XRIOiNTqqFaLSa7VuOC6PT6Awcw1GiwmUxmwDmCyWKzWGy2Oz2B0RH1IAGEXqoPkDvryBd8hEZheEiGRyORiHRGMRyNwouLSGcpG4QFIcBpxBhpTAnPr1S8tW5AnqDegEMbTUJzd99W5pSE6M86AARB7e7Aga63e5PF6yOTu77UajEbjkOgxsilcikBjEGjkMUvU6yaWyig0ejR-CUSjkQjO0iyNzRVCqHDAAAyIAcudFEWANSd-JevipsgAkr7219vgAtAAqAHEYBOB0Y4PgAJoZADSWkoSEoADVosBCPgYL4htuAMpZl0gGDAIeR8fTmAQWRT08AVRgOBg0QAcpJuOx2AyMABzANxqAAKQvKs3RHB5nm+M4AAV1FOEBaj5WpQFSIURxNLQzR7BCcFPOAxCQVRUBEawHXw7sNSQBwkF8aRgH+KoInzKhaATbgYz9SsYGOQ4R04wsE0rBwQGlYhKzeO9fmCYERWxREIShVR0lULIcjyAoigxZFESxNEqgxXF6iaQk2g6UkYG6ZJen6QYRjGOlplmeZFjQVl1k2bZdhwfZVGElTRUI0hdmkytjkCY480rNt2NHRLKxwpLeVM+ihLzEgC246hK3EFKOMrNxyOlCtwv0pKZPCrRspE3KuKLP0TipHAAG0djcFiMkCIQAF0oCpbytCENr6w65IQFkJwpFOcQRDGoa8P1CbOtbeazko5aoE7OBxuOdqOtkGBrVUJaQBWIaFgudRWwyAMgxYwMpAmVQetgR1MBEQIoH4NY-o6gAiEbljG4GABpgYYyQdS0qHgd8QohGBgbMECVjhuC8Hxr0wIXAaJBpHaBw3HsY4+3+jGcwINQtGAPq7m63r+shzaFp2oRIdO87LpWemEAcVIoCOiiHCW8a+1UWQZHkUhJxnOcF2XNcNy3Xd90PY8z0wTRrzlqAFYfJ8X3fT8fz-ACgJAsDwKAA
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: 775d968f4f151ae2f772497eb0b93ef6bbc538f8bd176c5798aa656731b6bb94

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:19 GMT
content-encoding: gzip
via: 1.1 google
last-modified: Wed, 13 Dec 2023 03:39:19 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 11
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 200 reloadcampaigns
events.bouncex.net/track.gif/ 42 B
60 B 65ms
65ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/reloadcampaigns?wklz=E4UwNg9ghgJgxlAtgBygSwOYDsDOAuOAVxwBcJEA3KYNKAIzBBwF4BSAdgCFWAmH1DCAD6JAJ7IQvHqwDMAQSnUSaOIym8AwlMQQYUMEIpocaBpL6yFfAGb6c56Ty19Yh46bUX5UksEIPNKRhrZCFgBgg4AGt1bz4sCBIwkFhRdXYAEQAyUEhYBBR0bHwsJBBmKhp6RhzwaHgkVExcPDEJZgFhNvMNVyMTM01g0PDIaKydGHKABiyAdxA6ExIQNBhmGQBOTZks-rRldYBGdmmeABYZAA52AFYrq6OZGXP2LKmjOFX1h+mANnO92mZx4Lx4m2m13OWU6RhAczWzCOWXsAEd-FgvoieFlVGgQFgSMpEEwSI0kacLtc7pt2DIcXiCWTkGgKCBgCYIFhmGSMLsPipyjAYVBBCJxOUlCoajgIIRgF9mAs6FlRUzmMR2SiINYktiAFoAFQA4tYAIowY0AZQAqtYcNYAGIAORWfwAXu7RAArACS3owVwAUlkABbUGBCA0m6yG30AD0IRwAmqIANJgGRwGQANUdJHYR2soaiOatQA
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 idl.js Show response
assets.a-mo.net/js/ Frame 8AA7 3 KB
2 KB 39ms
39ms Script
application/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=www.mercurynews.com&e=27&uid=7b36d79c-66a4-4783-bbae-f47394c1228d
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8c49bc14e5b5041853d619fe2dc1b01b28bfd4974b8e732f13fa4943efaada3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
via: 1.1 72aa1f6d307a536bbaffdcdb498b124c.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 418
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 02 Nov 2023 21:08:31 GMT
server: cloudflare
etag: W/"771a6a92588a8fb45e42a04fa3fe9ddd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600
cf-ray: 834b2de98ef7db19-MIA
x-amz-cf-id: UXeQ_aoLfWLYcbXpgrA4E8MpYFq5IjKEOA5S4ZnVBLHNX-SvIITlHA==
expires: Wed, 13 Dec 2023 04:39:19 GMT

GET
H2

200

bidswitch
sync-dmp.mobtrakk.com/match/ Frame 8AA7
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=7b36d79c-66a4-4783-bbae-f47394c1228d&gdpr=0&us_privacy=1---
https://sync-dmp.mobtrakk.com/match/bidswitch?id=${user_id}&gdpr=0&consent=&usp=1---&ssp=adaptmx&bsw=5a3f1a6b-829a-444b-9541-a9778d3d14bc

43 B
241 B

60ms
58ms

Image
image/gif

5.161.195.128
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync-dmp.mobtrakk.com/match/bidswitch?id=${user_id}&gdpr=0&consent=&usp=1---&ssp=adaptmx&bsw=5a3f1a6b-829a-444b-9541-a9778d3d14bc

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512

Protocol

Server

5.161.195.128 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),

Reverse DNS

static.128.195.161.5.clients.your-server.de

Software

nginx /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: nginx
content-length: 43
content-type: image/gif

Redirect headers

Location: //sync-dmp.mobtrakk.com/match/bidswitch?id=${user_id}&gdpr=0&consent=&usp=1---&ssp=adaptmx&bsw=5a3f1a6b-829a-444b-9541-a9778d3d14bc
Date: Wed, 13 Dec 2023 03:39:19 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

204

yahoo
prebid.a-mo.net/setuid/ Frame 8AA7
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?uid=7b36d79c-66a4-4783-bbae-f47394c1228d
https://prebid.a-mo.net/setuid/yahoo?uid=y-oEhoeXNE2uEABDywW2mUVaiqiTPtcdGPu4_5fgM-~A

0
112 B

58ms
57ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-oEhoeXNE2uEABDywW2mUVaiqiTPtcdGPu4_5fgM-~A
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-oEhoeXNE2uEABDywW2mUVaiqiTPtcdGPu4_5fgM-~A
date: Wed, 13 Dec 2023 03:39:19 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
prebid.a-mo.net/ Frame 8AA7
Redirect Chain

https://rtb.openx.net/sync/prebid?&gdpr=0&us_privacy=1---&r=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D7b36d79c-66a4-4783-bbae-f47394c1228d%26bidder%3Dopenx%26uid%3D%24%7BUID%7D
https://prebid.a-mo.net/setuid?A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=openx&uid=43164c12-e95a-4206-9005-3184ae78cce5

0
136 B

58ms
57ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=openx&uid=43164c12-e95a-4206-9005-3184ae78cce5
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:20 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:20 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://prebid.a-mo.net/setuid?A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=openx&uid=43164c12-e95a-4206-9005-3184ae78cce5
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 154

GET
H2

204

setuid
prebid.a-mo.net/ Frame 8AA7
Redirect Chain

https://ap.lijit.com/pixel?&gdpr=0&us_privacy=1---&redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D7b36d79c-66a4-4783-bbae-f47394c1228d%26bidder%3Dsovrn%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=sovrn&uid=Hz-bhPZH-3xZJd9nRju811w_

0
112 B

57ms
57ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=sovrn&uid=Hz-bhPZH-3xZJd9nRju811w_
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:19 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Date: Wed, 13 Dec 2023 03:39:19 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://prebid.a-mo.net/setuid?A=7b36d79c-66a4-4783-bbae-f47394c1228d&bidder=sovrn&uid=Hz-bhPZH-3xZJd9nRju811w_
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2 200 setuid
ow.pubmatic.com/ Frame 8AA7 0
248 B 243ms
66ms Image
text/html 104.36.115.123
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=amx&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&do=www.mercurynews.com
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.123 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:20 GMT
content-length: 0
content-type: text/html

GET
H/1.1 200
OK setuid
prebid-server.rubiconproject.com/ Frame 8AA7 0
560 B 523ms
58ms Image
text/html 69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=amx&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&do=www.mercurynews.com
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html

GET
H2 200 setuid
ib.adnxs.com/prebid/ Frame 8AA7 43 B
1 KB 71ms
70ms Image
image/gif 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=7b36d79c-66a4-4783-bbae-f47394c1228d&do=www.mercurynews.com

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:19 GMT
an-x-request-uuid: 064728c3-fdd4-4f27-aa41-ab59f0736451
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.70; 38.132.118.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H/1.1 200
OK delete
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/ Frame 0
0 64ms
63ms Preflight 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=95602427021ee80bb103979989774ba4&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method: GET
Origin: https://www.mercurynews.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Access-Control-Allow-Headers: access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Wed, 13 Dec 2023 03:39:19 GMT
X-Powered-By: ASP.NET

GET
H/1.1 200
OK delete Show response
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/ 0
806 B 605ms
604ms Fetch 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=95602427021ee80bb103979989774ba4&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Requested by: Host: cdn.pranmcpkx.com
URL: https://cdn.pranmcpkx.com/prod/dfm/t8y9347t.min.js?20231112
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

source-system: Plugin
site-code: DFM
autoqa: false
accept-language: en-US,en;q=0.9
settingskey: BANG,MERC
authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NzQ0Mzg3NTF9._lghYrKev7HNZAr1O0VrI7y0MVwy14nOfK4zc3KLoKk
ssid: a7624748f029bcda0dc446c0aa50c54a
environment: prod
config-code: BANGWPPRODWAB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: application/json
access-control-allow-origin: *
accept: application/json
attr: MERC
location: System
Referer: https://www.mercurynews.com/
version: Version: 2.8.6.1

Response headers

Expires: -1
Pragma: no-cache
Date: Wed, 13 Dec 2023 03:39:20 GMT
X-Server-Time: 12/13/2023 3:39:21 AM
Server: Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET, ASP.NET
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Server-Time,Request-Context
Cache-Control: no-cache
Content-Length: 0
Request-Context: appId=cid-v1:94ae5057-927d-4045-bf63-1b3776adbf9e

GET
H3 200 css
fonts.googleapis.com/ 2 KB
440 B 100ms
99ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,700,900&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0cee972f52f443216ed569505738e89b08925201f31b5d7a51783ee9a0dcc785

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 13 Dec 2023 03:39:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 03:00:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 13 Dec 2023 03:39:20 GMT

POST
H2 200 VideoBidRequestHandlerServlet Show response
ch-wf.taboola.com/ 4 KB
2 KB 258ms
254ms XHR
application/json 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ch-wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=955&height=537&pubid=169497&tagid=953497&crid=-1&noaop=5&sortOrderType=0&cb=1702438761198&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=0&seq=2&pv=1583&pt=-1337194392&tz=-600&viewable=true&ddast=V8Kq0CLAaweienCtrrEhNg9U5OFbTXJS4AAABgYMD_AEnZdrvBbLdxK4e73Vq08k3WEotz5BauFjPbZDNzmVwTIyAp2243mO02buVwt1uLVr7JWmJxjtzC1WJmm2xmLpNrYgUewTr93Q7Ty2SQtDx-g6TlMhsUFL_tZZCxXCY3QEPT6fC57vW63--udlk-rsvz7vJ97hq_2y8ZTDZ7xWSvmOwlr8_n6bC71Q67W2Z2ujxvmeXvdotcdrfD8nWL_m6xw_jWPU1Ht9zvFj09Xpfprbe8BQ_P5_C3nP5yAAAAAPDg____HwIAAABABAAAAAAJAAAAABQCKvxbELgAAAAAgOH___9fA8D4BgFnlgOCu3wH5d_y9QcAAAAAEAAAAAAkABBanksAvJxEn_j_________jzFAn3kj4______GQg-ABx8AD0IAAAAuhoSPHQrFGg0oEjlQKcIIAAAAgAmhndGRSTpBxaLK__9_vxWAKwAAAYxhQctbWXQHJd7CAAAAEIxZoIfF7zc77Bq_22X-_________838n_lHIzQyM5NGeBKeVM0vIADAml9AAAA26gYA4E0AnKBD0IrBYHUUYjecLXazxXAyOwAAAAB3_v____WA3GQ12thsK8NiM9vYXMuFxWRzrnyb2cg4mpkms-2RDEGn1HKprujjEazT3-0wvUwGScvjN0haLrNBQfHbXgYZy2WynwlbjFaTyWY5nC0Xk8FwNByN9mcgJoMBmojBcjmZLCa71Wg12gx3o9lggQRiMEEULRpMVqPRZDEZrkaT1Wy52O02iKJVq9loMxiuZpPZbrcaDobL0QhN2GK0mkw2y-FsuZgMhqPhaDREMGQaTAYLj3Gt8g2Ha9HKMXMrVyuTW-JYDBajjWE4GU3cotfH9PFNFh6TzYsEA872InlapBPhzOVy7pazmWPk3ExGs43FZhtZZoPNxDlzTjamiViiOVmkE9ll35usRhubbWVYbGYbm2u5sJhszpVvMxsZRzPTZLYvmQaTwcJjXKt8w-FatHLM3MrVyuSWOBaDxWhjGE5GE7fo9TF9fJOFx2TzN3aDyWgz3K0W-8ZuMBlthrvVYt-hM3xXn7NROlmKPT6vVjRNfmxOg8JlsHinRYu0dTj6jDqvbSJMrU07x8QqtEq8BoXn4FF9TSuJ1G99iLfrjfdgVMQSwUU6UbtMTofd5fv8LH_X4a12WT6uy_Pu8n0uYonSdJFO9JLBZLNXTPaKyV7y-nyeDrtb7bC7ZWany_OWWf5ut8hldzssX7fo7xY7jG_d03R0y_1u0dPjdZneestb8PB8Dn_L6SKWCE4X6UT0Mp4u6j9qmOFcsZnMFYvhXDdYJQAAAAAAAAAASzDJdBMAAAAAJ4PazAaL1TodzGA52AxXywVQoV6jCxgEAAAAAABglxR1LuLY-2ZSscYe02iXyemwu3yfn-XvOrzVLsvHdXneXb7PlQFUpP8w2-wzgljL2bIGAAAggA0AACCA2268CTiz4v7____HAQAAAJBDDwAAwH8f0BAzMzMzczO_ghgMh5P9A1Ah1nK2ut1Yy9kKKFC7CQQACKgH!&proto=2,3,5,6&encoded=1&pstn=vforce2&callback=&wfv=1&amp=0&qsz=10&ft=0&pb=0&pagg=1&sd=0&ctsldr=0&dtagid=3090385&dpubid=536015&abtst=DLR_vA!adxsub-out_vA!adxsub-out_vB!rbcatc_vA!tmaxc_vB&mPre=0.033&cirf=https%3A%2F%2Fwww.mercurynews.com&en=1&subu=0&panid=716fd8efafe78c1d3284f497fbe7a9fb927a2e1964fff32f4b873cb31e9fbc5f
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: 69f1e7ff3f810a1388413e26efc591d9a4ce18cc31ca7e2668a1f6f878a45ab5

Request headers

Referer: https://www.mercurynews.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:21 GMT
content-encoding: gzip
server: nginx
machineid: 1851
vary: Accept-Encoding
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.mercurynews.com
cache-control: no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 32E0 0
128 B 60ms
58ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156512&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:20 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 104ms
103ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 10:01:47 GMT
x-content-type-options: nosniff
age: 495454
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 10:01:47 GMT

GET
H3 200 S6u9w4BMUTPHh50XSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 22 KB
22 KB 85ms
84ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08664859baab5ed98f0bf818ed77e38464ff1826dc6406d5ecbd651409afbd92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:49:49 GMT
x-content-type-options: nosniff
age: 496172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22504
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:12:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 09:49:49 GMT

GET
H3 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 75ms
74ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mercurynews.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:48:16 GMT
x-content-type-options: nosniff
age: 496265
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 09:48:16 GMT

GET
BLOB 200
OK 7681847d-32fe-4dec-b4e1-04bad656b09e
https://prebid.a-mo.net/ Frame 8AA7 180 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://prebid.a-mo.net/7681847d-32fe-4dec-b4e1-04bad656b09e
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 355793195239b15ac89c16dfec993f89bbf3b220ac38d07555c2a01446da0a6c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length: 180
Content-Type

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58771/ Frame 8AA7 316 B
608 B 61ms
61ms XHR
application/json 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58771/fed?1p=0&gdpr=0&gdpr_consent=&us_privacy=&pixelId=58771&puid=7b36d79c-66a4-4783-bbae-f47394c1228d

Requested by

Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=www.mercurynews.com&e=27&uid=7b36d79c-66a4-4783-bbae-f47394c1228d

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

71334a5e7048125ecd5e43fae0bd8d43f0beb49cfcd8a89db05ac3aa5bdff329

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://prebid.a-mo.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Dec 2023 03:39:21 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://prebid.a-mo.net
content-type: application/json
access-control-allow-credentials: true

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 58ms
58ms Image
image/gif 54.198.156.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pe&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Pacific%2FHonolulu&tzoff=600&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&f_privb=0&tid=5585d946-6a51-4458-817a-9818c053eff6&pid=b95fdc8e-6db9-4524-86e6-2fed99ef0217&dtm=1702438761472&qnm=_matherq&visible=1&tabid=20d6cd17-3152-45e1-a085-1e4a77a1cb60&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F12%2F12%2Frussian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport%2F&vp=1600x1200&ds=1600x1200&tofa=1702438751&vid=1&lvidt=1702438751&duid=efb485d2-e5b6-4b64-b1da-6f3c1f491b10&fp=1905609432&cid=ma23578&mrk=239876506&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTcwMjQzODc0OTA2MCIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIzNy4zbWIiLCJoZWFwVCI6IjU2LjhtYiIsImZzdFBhaW50IjoiNzc2IiwiZmV0Y2hTIjoiMCIsImRvbWFpblMiOiI5IiwiZG9tYWluRSI6IjkiLCJjb25uUyI6IjkiLCJjb25uRSI6Ijc3Iiwic3NsUyI6IjQwIiwicmVxdVMiOiI3NyIsInJlc3BTIjoiMTA5IiwicmVzcEUiOiIxNTYiLCJkb21Mb2FkIjoiMTEzIiwiZG9tSW50ZXIiOiI5NzgiLCJkb21Mb2FkUyI6Ijk4OCIsImRvbUxvYWRFIjoiMTAwMiJ9fQ
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.156.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-156-105.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.mercurynews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Wed, 13 Dec 2023 03:39:21 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 32E0 913 B
1 KB 56ms
56ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=37025529&p=156512&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: d727af8eaba61b5cbb90772bf2e4456378cc954f67569ed605a8640fefbcf8be

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 13 Dec 2023 03:39:21 GMT
content-length: 913
content-type: text/html; charset=UTF-8

GET
H2 200 syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 32E0 0
200 B 257ms
75ms Image
text/plain 54.192.51.7
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-7.yul62.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 03:39:22 GMT
via: 1.1 e4d959ba5c709b88eb04934bd0d1eeea.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: YUL62-C2
content-length: 0
x-amz-cf-id: DyG3bBNUKkwMy9JsmDppTeumvuGOAh27uhljwGlPv5o7lsaAked15A==
x-cache: Error from cloudfront

GET

/
p.adsymptotic.com/d/px/ Frame 32E0
Redirect Chain

https://idsync.rlcdn.com/712188.gif?partner_uid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=
https://pippio.com/api/sync?pid=5324&it=1&iv=121518816817da2aa04aa61e7c6e318e662496efde70f116d6f4f9e9384f7fba791426b5417dce21&_=2
https://p.adsymptotic.com/d/px/?_pid=16257&_psign=5a9f251662be469b9732c38b03f11952&_redirect=https%3A%2F%2Fpippio.com%2Fapi%2Fsync%3Fpid%3D710202%26it%3D1%26iv%3D%24%7BUUID%7D&_rand=02012242

0
0

GET
H2 200 gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837/gdpr=0/ Frame 32E0 49 B
264 B 66ms
64ms Image
image/gif 54.209.94.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=1BB735AD-30E7-4B35-805F-E7EFB2FDA837/gdpr=0/gdpr_consent=
Requested by: Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.94.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-94-68.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Dec 2023 03:39:22 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.48.73
content-length: 49
expires: 0

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame 32E0 95 B
124 B 64ms
63ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=1BB735AD-30E7-4B35-805F-E7EFB2FDA837&gdpr=0&gdpr_consent=

Requested by

Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/12/12/russian-man-flies-from-denmark-to-lax-with-no-ticket-or-passport/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS