go.behindthemarkets.com Open in urlscan Pro
35.202.21.90 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://zpr.io/t2wJe
Effective URL:
https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=p...
Submission: On April 21 via api (April 21st 2020, 9:19:37 am UTC) from ES

Summary HTTP 86 Redirects Behaviour Indicators

Summary

This website contacted 16 IPs in 7 countries across 22 domains to perform 86 HTTP transactions. The main IP is 35.202.21.90, located in United States and belongs to GOOGLE, US. The main domain is go.behindthemarkets.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 14th 2020. Valid for: 3 months.

This is the only time go.behindthemarkets.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.174.156.76 54.174.156.76	14618 (AMAZON-AES) (AMAZON-AES)
1 1	67.43.12.232 67.43.12.232	32244 (LIQUIDWEB) (LIQUIDWEB)
1 1	34.246.99.35 34.246.99.35	16509 (AMAZON-02) (AMAZON-02)
1 1	35.241.23.11 35.241.23.11	15169 (GOOGLE) (GOOGLE)
3	35.202.21.90 35.202.21.90	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:824::200a	15169 (GOOGLE) (GOOGLE)
1	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	2a00:1450:400... 2a00:1450:4001:80b::2013	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:815::2008	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::2000	10310 (YAHOO-1) (YAHOO-1)
58	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:816::2003	15169 (GOOGLE) (GOOGLE)
1 1	178.250.0.163 178.250.0.163	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	74.119.119.150 74.119.119.150	19750 (AS-CRITEO) (AS-CRITEO)
1	2606:4700::68... 2606:4700::6813:9408	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2a00:1450:400... 2a00:1450:4001:819::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
5	35.192.151.63 35.192.151.63	15169 (GOOGLE) (GOOGLE)
86	16

1 54.174.156.76 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-174-156-76.compute-1.amazonaws.com

zpr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.43.12.232 (Lansing, United States) 1 redirects

ASN32244 (LIQUIDWEB, US)
PTR: host.marketbeat.com

www.americanconsumernews.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.246.99.35 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-246-99-35.eu-west-1.compute.amazonaws.com

tracking.imspublishergroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.23.11 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 11.23.241.35.bc.googleusercontent.com

wba.clqtrk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.202.21.90 (United States)

ASN15169 (GOOGLE, US)
PTR: 90.21.202.35.bc.googleusercontent.com

go.behindthemarkets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
btm-btm-btm.lpages.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

js.center.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.leadpages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::2000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

58 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

lh3.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:816::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.163 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

sslwidget.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)

widget.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9408 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.192.151.63 (United States)

ASN15169 (GOOGLE, US)
PTR: 63.151.192.35.bc.googleusercontent.com

api.leadpages.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
58	googleusercontent.com lh3.googleusercontent.com	674 KB
5	leadpages.io api.leadpages.io	2 KB
3	gstatic.com fonts.gstatic.com	39 KB
2	lpages.co btm-btm-btm.lpages.co
2	facebook.com www.facebook.com	348 B
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
2	criteo.com 1 redirects sslwidget.criteo.com widget.us.criteo.com	1 KB
2	yimg.com s.yimg.com	5 KB
2	facebook.net connect.facebook.net	189 KB
2	center.io js.center.io	5 KB
1	doubleclick.net stats.g.doubleclick.net	102 B
1	leadpages.net static.leadpages.net	15 KB
1	crazyegg.com script.crazyegg.com	42 KB
1	googletagmanager.com www.googletagmanager.com	31 KB
1	criteo.net static.criteo.net	10 KB
1	googleapis.com fonts.googleapis.com	1 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	7 KB
1	behindthemarkets.com go.behindthemarkets.com	69 KB
1	clqtrk.com 1 redirects wba.clqtrk.com	454 B
1	imspublishergroup.com 1 redirects tracking.imspublishergroup.com	2 KB
1	americanconsumernews.net 1 redirects www.americanconsumernews.net	428 B
1	zpr.io 1 redirects zpr.io	291 B
86	22

	Domain	Requested by
58	lh3.googleusercontent.com	go.behindthemarkets.com
5	api.leadpages.io	js.center.io static.leadpages.net
3	fonts.gstatic.com	go.behindthemarkets.com
2	btm-btm-btm.lpages.co	static.leadpages.net
2	www.facebook.com	go.behindthemarkets.com
2	www.google-analytics.com	1 redirects www.googletagmanager.com
2	s.yimg.com	go.behindthemarkets.com s.yimg.com
2	connect.facebook.net	go.behindthemarkets.com connect.facebook.net
2	js.center.io	go.behindthemarkets.com js.center.io
1	stats.g.doubleclick.net	go.behindthemarkets.com
1	static.leadpages.net	go.behindthemarkets.com
1	script.crazyegg.com	www.googletagmanager.com
1	widget.us.criteo.com	go.behindthemarkets.com
1	sslwidget.criteo.com	1 redirects
1	www.googletagmanager.com	go.behindthemarkets.com
1	static.criteo.net	go.behindthemarkets.com
1	fonts.googleapis.com	go.behindthemarkets.com
1	maxcdn.bootstrapcdn.com	go.behindthemarkets.com
1	go.behindthemarkets.com
1	wba.clqtrk.com	1 redirects
1	tracking.imspublishergroup.com	1 redirects
1	www.americanconsumernews.net	1 redirects
1	zpr.io	1 redirects
86	23

This site contains no links.

Subject Issuer	Validity	Valid
go.behindthemarkets.com Let's Encrypt Authority X3	`2020-04-14` - `2020-07-13`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-04-01` - `2020-06-24`	3 months	crt.sh
*.criteo.net DigiCert ECC Secure Server CA	`2020-03-30` - `2020-06-28`	3 months	crt.sh
*.center.io Go Daddy Secure Certificate Authority - G2	`2020-01-21` - `2022-01-21`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-04-01` - `2020-06-24`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-05-30`	3 months	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-04-16` - `2020-05-31`	a month	crt.sh
*.googleusercontent.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.us.criteo.com DigiCert ECC Secure Server CA	`2019-06-12` - `2020-06-16`	a year	crt.sh
ssl945600.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2020-01-28` - `2020-08-05`	6 months	crt.sh
*.leadpages.net Go Daddy Secure Certificate Authority - G2	`2019-03-11` - `2021-03-11`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-04-01` - `2020-06-24`	3 months	crt.sh
*.lpages.co Go Daddy Secure Certificate Authority - G2	`2020-02-24` - `2022-02-24`	2 years	crt.sh
*.leadpages.io Go Daddy Secure Certificate Authority - G2	`2019-11-12` - `2021-11-12`	2 years	crt.sh

This page contains 4 frames:

Primary Page: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
Frame ID: C1097CDC859D287600D3BE46D7A885F3
Requests: 83 HTTP requests in this frame

Frame: https://js.center.io/identify.html
Frame ID: EEE65C40277D35492079CF29BA66FDC1
Requests: 1 HTTP requests in this frame

Frame: https://btm-btm-btm.lpages.co/serve-leadbox/bbuMx9RrbckVzBMygBHAXf/?id=1004&ojid=653249f20a7c486aa89bd338f65700a6&sub2=covid
Frame ID: 9E070424ADD6B9D0EC585423F9983A7C
Requests: 1 HTTP requests in this frame

Frame: https://btm-btm-btm.lpages.co/serve-leadbox/eTJHMHqKHNn2VicLJospKC/?id=1004&ojid=653249f20a7c486aa89bd338f65700a6&sub2=covid
Frame ID: 13763C53E5EA562DBFF16A342C56A3AC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://zpr.io/t2wJe HTTP 302
http://www.americanconsumernews.net/scripts/click.aspx?WebPushNotificationID=6908&SocialPush=1 HTTP 301
https://tracking.imspublishergroup.com/aff_c?offer_id=4797&aff_id=1004&url_id=16333 HTTP 302
https://wba.clqtrk.com/8LJN3/2BGSTD/?creative_id=18&source_id=pn&sub1=1004&sub2=covid HTTP 302
https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_camp... Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

86
Requests

100 %
HTTPS

62 %
IPv6

22
Domains

23
Subdomains

16
IPs

7
Countries

1107 kB
Transfer

2418 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://zpr.io/t2wJe HTTP 302
http://www.americanconsumernews.net/scripts/click.aspx?WebPushNotificationID=6908&SocialPush=1 HTTP 301
https://tracking.imspublishergroup.com/aff_c?offer_id=4797&aff_id=1004&url_id=16333 HTTP 302
https://wba.clqtrk.com/8LJN3/2BGSTD/?creative_id=18&source_id=pn&sub1=1004&sub2=covid HTTP 302
https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13

https://sslwidget.criteo.com/event?a=66045&v=5.5.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&tld=behindthemarkets.com&dtycbr=25623 HTTP 302
https://widget.us.criteo.com/event?a=66045&v=5.5.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&tld=behindthemarkets.com&dtycbr=25623

Request Chain 77

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=959593418&t=pageview&_s=1&dl=https%3A%2F%2Fgo.behindthemarkets.com%2Fcut-paste-covid%2F%3Fojid%3D653249f20a7c486aa89bd338f65700a6%26utm_source%3D6%26utm_campaign%3D18%26utm_medium%3Dpn%26id%3D1004%26sub2%3Dcovid&ul=en-us&de=UTF-8&dt=%22Cut%20%26%20Paste%22&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAEAB~&jid=1299418597&gjid=1013354896&cid=1388186900.1587460761&tid=UA-102395123-1&_gid=251268692.1587460761&_r=1&gtm=2wg480WNRH3TX&z=580816886 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-102395123-1&cid=1388186900.1587460761&jid=1299418597&_gid=251268692.1587460761&gjid=1013354896&_v=j81&z=580816886

86 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
go.behindthemarkets.com/cut-paste-covid/
Redirect Chain

http://zpr.io/t2wJe
http://www.americanconsumernews.net/scripts/click.aspx?WebPushNotificationID=6908&SocialPush=1
https://tracking.imspublishergroup.com/aff_c?offer_id=4797&aff_id=1004&url_id=16333
https://wba.clqtrk.com/8LJN3/2BGSTD/?creative_id=18&source_id=pn&sub1=1004&sub2=covid
https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

575 KB
69 KB

428ms
145ms

Document
text/html

35.202.21.90
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

35.202.21.90 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

90.21.202.35.bc.googleusercontent.com

Software

Leadpages /

Resource Hash

39268815166a0df989060fd89756d058766a8bf6938e1e5ca1cd12d62310994c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

:method: GET
:authority: go.behindthemarkets.com
:scheme: https
:path: /cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 21 Apr 2020 09:19:19 GMT
content-type: text/html
vary: Accept-Encoding
last-modified: Sun, 19 Apr 2020 05:13:46 GMT
etag: W/"a0af6307792d494f83fcfc21c7f98c57"
x-cache: MISS, HIT
cache-control: no-cache
server: Leadpages
strict-transport-security: max-age=15768000
content-encoding: br

Redirect headers

status: 302
server: nginx
date: Tue, 21 Apr 2020 09:19:19 GMT
content-type: text/html; charset=utf-8
content-length: 191
location: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
set-cookie: uniqueClick_2BGSTD=0e201eec-885d-41a8-a8ef-0472b87c54b7:1587460759; Path=/; Expires=Wed, 22 Apr 2020 09:19:19 GMT; SameSite=None transaction_id=653249f20a7c486aa89bd338f65700a6; Path=/; Expires=Mon, 20 Jul 2020 09:19:19 GMT; SameSite=None
vary: Origin
x-eflow-request-id: ffc41962-5846-4e91-bf4b-ae8a19beb33b
via: 1.1 google
alt-svc: clear

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.3/css/ 28 KB
7 KB 8ms
7ms Stylesheet
text/css 2001:4de0:ac19::1:b:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.3/css/font-awesome.min.css

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:19:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:20 GMT
status: 200
etag: "1544639720"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 6662

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 17ms
16ms Stylesheet
text/css 2a00:1450:4001:824::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,500,700|Roboto:300,400,500,700

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b6fadd7694e1afed921bafa1c1af6ec642269dc660caf898010cfc0b08159baf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Apr 2020 09:19:19 GMT
server: ESF
date: Tue, 21 Apr 2020 09:19:19 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Apr 2020 09:19:19 GMT

GET
H2 200 ld.js Show response
static.criteo.net/js/ld/ 29 KB
10 KB 47ms
14ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/ld.js
Requested by: Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 6a60018cab3d38d035188490d869d5dc1283a7dd115917226df457ca92887f7f

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:19:19 GMT
content-encoding: gzip
last-modified: Mon, 16 Dec 2019 15:00:50 GMT
server: nginx
etag: W/"5df79c22-7533"
status: 200
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
timing-allow-origin: *
expires: Wed, 22 Apr 2020 09:19:19 GMT

GET
H2 200 center.js Show response
js.center.io/ 12 KB
5 KB 38ms
14ms Script
application/javascript 2a00:1450:4001:80b::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.center.io/center.js
Requested by: Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80b::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: cc08eb3316359de0d8f025efee489da73ca552209a0c9cab6b00894d7fa21d42

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:15:49 GMT
content-encoding: gzip
server: Google Frontend
age: 210
etag: "OMWYXg"
content-type: application/javascript
status: 200
x-cloud-trace-context: cb90a03aa44d9389b6c765050c00ef4a
cache-control: public, max-age=300
content-length: 5417
expires: Tue, 21 Apr 2020 09:20:49 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 89 KB
31 KB 24ms
22ms Script
application/javascript 2a00:1450:4001:815::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

93ccd8d9abf900853b2be265d860d889f342f4e09946ba3fbe15d0e7269dc249

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:19:19 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 31391
x-xss-protection: 0
last-modified: Tue, 21 Apr 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 21 Apr 2020 09:19:19 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 199 KB
53 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2f220735682253606c6f4b885706516109a48fbd522f9928c717ae7864f0ae8e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 53887
x-xss-protection: 0
pragma: public
x-fb-debug: BBE5PRZaCd+dKACDL3j+UUqOejJwlpSmvLB12qN3SIlbXupiAeF71V3oRsDRFUjsGOtDwyftYUvcM6iPUSjfdg==
x-fb-trip-id: 2000377899
x-frame-options: DENY
date: Tue, 21 Apr 2020 09:19:19 GMT, Tue, 21 Apr 2020 09:19:19 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 14 KB
5 KB 18ms
17ms Script
application/javascript 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

5b54138a1228bb354b4d200ba40bca6e8bf05c3476b3013daf8fa8162a414582

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 21 Apr 2020 08:35:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2603
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 5398
x-amz-id-2: 2B347ekqeMEiC3ZNjfprLkOQoLte2XwRp3xla/acNL47pe0PA2+Cp0ymGHQsKPiRYmCTgDKGFjs=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sun, 23 May 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Fri, 17 Apr 2020 10:13:12 GMT
server: ATS
etag: "262ad28777cd04301eaf1ed832269103-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 6F0F3CFB25E0E8B3
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: .3pslEVav9FDmkNX3peqHq9djDal2LXy
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 tdpih9HNi11Inu5FoM-qMyMwp7Knvga57hIvCWRxynnctJ3skd3Oe7AMGk4UqDpd1FvBCX-upUnBc5zYQGfD=s16
lh3.googleusercontent.com/ 377 B
797 B 33ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/tdpih9HNi11Inu5FoM-qMyMwp7Knvga57hIvCWRxynnctJ3skd3Oe7AMGk4UqDpd1FvBCX-upUnBc5zYQGfD=s16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

012baa4613733b5bfae091a6f406ab9dd0545f74eef4a92a5d745b4141efd5e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:18:38 GMT
x-content-type-options: nosniff
age: 41
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 377
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 16 Apr 2020 11:53:32 GMT

GET
H2 200 -ueFME1llxpzXmcTVMXoGVbty4CQL1JV6DV1QZhyjQWOBxlOYKLmpRbmyTUxkeJExrkX_WI1vtMcuW6_Er8_=w16
lh3.googleusercontent.com/ 200 B
288 B 34ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/-ueFME1llxpzXmcTVMXoGVbty4CQL1JV6DV1QZhyjQWOBxlOYKLmpRbmyTUxkeJExrkX_WI1vtMcuW6_Er8_=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

4c7aade1168b2a14eb1c4fd2d217bb878da063890e6b4f04a67a8c2460589b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:18:38 GMT
x-content-type-options: nosniff
age: 41
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 200
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 18 Apr 2020 09:11:54 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
14 KB 8ms
6ms Font
font/woff2 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato:300,400,500,700|Roboto:300,400,500,700
Origin: https://go.behindthemarkets.com

Response headers

date: Sat, 28 Mar 2020 09:55:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:45:54 GMT
server: sffe
age: 2071401
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14176
x-xss-protection: 0
expires: Sun, 28 Mar 2021 09:55:58 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
14 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato:300,400,500,700|Roboto:300,400,500,700
Origin: https://go.behindthemarkets.com

Response headers

date: Wed, 15 Apr 2020 01:32:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:45:55 GMT
server: sffe
age: 546391
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14044
x-xss-protection: 0
expires: Thu, 15 Apr 2021 01:32:48 GMT

GET
H2 200 10097363.json Show response
s.yimg.com/wi/config/ 2 B
174 B 21ms
17ms XHR
application/json 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10097363.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:18:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43
status: 200
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-amz-request-id: 3098CEF5F4D0E8AA
x-amz-id-2: 0m1sF+EPBgHtdq+cv1+qKLCih2HgHNUPpXLifUoTVEGX+xOcVQYR1J428L7pMFTyjjS8gAmUySc=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 22

GET
H2 200 458841784766826 Show response
connect.facebook.net/signals/config/ 524 KB
136 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/458841784766826?v=2.9.16&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9314e6eba316b602c5f951462309f317ad8198b0f404723ddc8f87bf43a6968c

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 138809
x-xss-protection: 0
pragma: public
x-fb-debug: q7GOuutbtViPx6H8ZeTkN1FcP7L75BIAqq5kENmQ5lwONY66wcedj59jONA2giCC2GNkdUKKQd/s153kHF2p6g==
x-fb-trip-id: 2000377899
x-frame-options: DENY
date: Tue, 21 Apr 2020 09:19:20 GMT, Tue, 21 Apr 2020 09:19:20 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

event Show response
widget.us.criteo.com/
Redirect Chain

https://sslwidget.criteo.com/event?a=66045&v=5.5.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&tld=behindthemarkets.com&dtycbr=25623
https://widget.us.criteo.com/event?a=66045&v=5.5.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&tld=behindthemarkets.com&dtycbr=25623

1 KB
1 KB

396ms
125ms

Script
application/x-javascript

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.us.criteo.com/event?a=66045&v=5.5.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&tld=behindthemarkets.com&dtycbr=25623
Requested by: Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1f8366777ddedf8ffdf8408bc2f9244164b432e1b7c7cb01a082659f36f2226d

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Apr 2020 09:19:20 GMT
content-encoding: gzip
server: Microsoft-IIS/10.0
timing-allow-origin: *
x-powered-by: ASP.NET
vary: Accept-Encoding
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
status: 200
cache-control: no-cache
content-type: application/x-javascript
content-length: 864
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Apr 2020 09:19:19 GMT
status: 302
location: https://widget.us.criteo.com/event?a=66045&v=5.5.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&tld=behindthemarkets.com&dtycbr=25623
cache-control: no-cache
timing-allow-origin: *
content-length: 0
expires: 0

GET
H2 200 3329.js Show response
script.crazyegg.com/pages/scripts/0075/ 140 KB
42 KB 98ms
15ms Script
text/javascript 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0075/3329.js?440961
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca9e28fd55c966b6c32b3488c3d6e460dbcbc66aad630e16c2e76ba2d4374d79

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:19:20 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 499539
status: 200
content-length: 42221
cf-request-id: 023da1fa600000dfa9b6331200000001
last-modified: Wed, 15 Apr 2020 14:23:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
cf-ray: 587605d70944dfa9-FRA

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 6046
date: Tue, 21 Apr 2020 07:38:34 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Tue, 21 Apr 2020 09:38:34 GMT

GET
H2 200 T-3lUZOkr0pGJTg2MtnJnPCAdxJl-PdaWePMpIUm6SACxhH30rYiJ__GYJwtKqQpllM0HVKLGlmwN24gcY3f=w16
lh3.googleusercontent.com/ 520 B
612 B 9ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/T-3lUZOkr0pGJTg2MtnJnPCAdxJl-PdaWePMpIUm6SACxhH30rYiJ__GYJwtKqQpllM0HVKLGlmwN24gcY3f=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6999aa983455b07dde377b6a4ed25e2dd10db955692a190f470807f66dac8234

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 520
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 11 Apr 2020 18:36:34 GMT

GET
H2 200 n-SU2QHHlDctT5P7f9PGVlqioYi7pTTg8gvrwvg1ZlSiRL7bP8OT_fgfmJXYifHvL5xQ1K76TrDmpB7-T6cugKs=w16
lh3.googleusercontent.com/ 433 B
554 B 10ms
8ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/n-SU2QHHlDctT5P7f9PGVlqioYi7pTTg8gvrwvg1ZlSiRL7bP8OT_fgfmJXYifHvL5xQ1K76TrDmpB7-T6cugKs=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c8fbbcf2d0649035388da07bc7dcc853bcb657795b23480f5c69b29d012b0580

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 433
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 16 Apr 2020 03:00:26 GMT

GET
H2 200 -TFC9jwymVFSTYLZJwBNNd3_cpc7doEJWIawODlZoO0zvFjYItyDimfoc6tOz-bgtI7t0r8DYTMLo6QAQQk3Yw=w16
lh3.googleusercontent.com/ 380 B
446 B 14ms
11ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/-TFC9jwymVFSTYLZJwBNNd3_cpc7doEJWIawODlZoO0zvFjYItyDimfoc6tOz-bgtI7t0r8DYTMLo6QAQQk3Yw=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

5eca4f4b5617a6a3340cb0718305f83c846e780b2e6c476bfd65657ccef3f973

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 380
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 11 Apr 2020 18:36:35 GMT

GET
H2 200 Ag1U8DBGFuXf1H9sWrj9NjMaKEvgz7Ombpu9LUfiJnDAWnANfneCuZegr8dRCpGkU4uJJd-tO0NEHqSzzMBdkw=w16
lh3.googleusercontent.com/ 414 B
480 B 75ms
73ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/Ag1U8DBGFuXf1H9sWrj9NjMaKEvgz7Ombpu9LUfiJnDAWnANfneCuZegr8dRCpGkU4uJJd-tO0NEHqSzzMBdkw=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

bf11d42a92176d30156ad607f5a14a88a563e8cf7380139da6cf55cf8fdc3492

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 414
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 16 Apr 2020 03:00:26 GMT

GET
H2 200 WXJuVDbLzZBfFYSk8BwiBKsf4fAkvxyS9Slh9DAo5NEOPYM6bDd7S68U8L8UKLJZvnieo5pnxf4HiyhvB1K0UA=w16
lh3.googleusercontent.com/ 410 B
498 B 13ms
11ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/WXJuVDbLzZBfFYSk8BwiBKsf4fAkvxyS9Slh9DAo5NEOPYM6bDd7S68U8L8UKLJZvnieo5pnxf4HiyhvB1K0UA=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

198170846b0434afb6882e6fba0ca3ecf89606eac689efeed337d27f58c03ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 410
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 10 Apr 2020 17:32:48 GMT

GET
H2 200 bQUnb2Vox3KcySoFqr9aChfaBT-2JdUzDuZlv6PgQOmrB9n3zHgyFO_etSO8kDdfVlPuDQfEDMbyd2uQodVW5Q=w16
lh3.googleusercontent.com/ 422 B
487 B 12ms
10ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/bQUnb2Vox3KcySoFqr9aChfaBT-2JdUzDuZlv6PgQOmrB9n3zHgyFO_etSO8kDdfVlPuDQfEDMbyd2uQodVW5Q=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

78352af71219d6609638a84b754ab583b249f0b9e014c31f5e69825592ef9685

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 422
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 16 Apr 2020 03:00:26 GMT

GET
H2 200 DntvIx57RnCtFXT3MYAPt9AuIvz4XLKHJT-BticI0S0NwMlmYEtV-YKJfofwEB3gcuKyZmgzaQ3Hn9VgLMtnJQ=w16
lh3.googleusercontent.com/ 431 B
497 B 11ms
10ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/DntvIx57RnCtFXT3MYAPt9AuIvz4XLKHJT-BticI0S0NwMlmYEtV-YKJfofwEB3gcuKyZmgzaQ3Hn9VgLMtnJQ=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

28095f1880ca62a37b5b670df1f5181bb0a8c248fd5af1298f5ffa18d11ac28d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 431
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 16 Apr 2020 03:00:26 GMT

GET
H2 200 _cLv27DqXzglIWHABADrU2yT9UmMkrDdEy_4HCj56msO3GzwRpTW_Xqc6P0mRJuOvnGOwapFlr1yMMjpjIhXqA=w16
lh3.googleusercontent.com/ 423 B
489 B 11ms
9ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/_cLv27DqXzglIWHABADrU2yT9UmMkrDdEy_4HCj56msO3GzwRpTW_Xqc6P0mRJuOvnGOwapFlr1yMMjpjIhXqA=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

5e39fb322b3255593d8c11d3645744b46c5dfbf12be0afaec1bed9fc8eaca7a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 423
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:30 GMT

GET
H2 200 S4Ayd-wkGMteQ4KkwgkxoFboWY54ehpF51PPgaQLlqkEO03fgqUtP6I-R2igjGfsZEcCMVXBHGRuEKLSJE0dVw=w16
lh3.googleusercontent.com/ 415 B
504 B 10ms
9ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/S4Ayd-wkGMteQ4KkwgkxoFboWY54ehpF51PPgaQLlqkEO03fgqUtP6I-R2igjGfsZEcCMVXBHGRuEKLSJE0dVw=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

79a11d6064cc9c46c67a278bd868457f6b535fe91bac24fecf4282c45bd47935

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 415
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:30 GMT

GET
H2 200 vqR5aDTh5aEIINnAJetxRUclreknK5AnGmfqu2hsajHbJwFYB_iKGIjeqeJUWJNem6JCw53qzY_XdDZR8lqsdw=w16
lh3.googleusercontent.com/ 785 B
874 B 9ms
8ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/vqR5aDTh5aEIINnAJetxRUclreknK5AnGmfqu2hsajHbJwFYB_iKGIjeqeJUWJNem6JCw53qzY_XdDZR8lqsdw=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6c571f75d98b23e59a96e177fa3ba9fdac3bafbddbed3cd24a65591193ad382a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 785
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 11 Apr 2020 18:36:35 GMT

GET
H2 200 identify.html
js.center.io/ Frame EEE6 0
0 15ms
15ms Document
text/html 2a00:1450:4001:80b::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.center.io/identify.html
Requested by: Host: js.center.io
URL: https://js.center.io/center.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80b::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

:method: GET
:authority: js.center.io
:scheme: https
:path: /identify.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Response headers

status: 200
date: Tue, 21 Apr 2020 09:18:35 GMT
expires: Tue, 21 Apr 2020 09:23:35 GMT
etag: "OMWYXg"
x-cloud-trace-context: 5519b981f404f18cb55365a44e2ffa0c
content-type: text/html
content-encoding: gzip
server: Google Frontend
content-length: 2016
age: 45
cache-control: public, max-age=300

GET
H2 200 Y1LKhf0ke5Sx4mjNmF5QuR0OJ_eJgWm36tGewMnsqAwT9Vgi5khqwXrhOf_NUyduDk3hjrI4QG7GF8Edswsq=w16
lh3.googleusercontent.com/ 422 B
484 B 76ms
13ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/Y1LKhf0ke5Sx4mjNmF5QuR0OJ_eJgWm36tGewMnsqAwT9Vgi5khqwXrhOf_NUyduDk3hjrI4QG7GF8Edswsq=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

96f21c60dac45fa2c524e10fc2f10c21a3bb46cbb93c14f7fc26a458209ca6ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 422
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 09 Apr 2020 18:00:21 GMT

GET
H2 200 FG4ErIy91xCYcbduLvglqUSQRCBXDD3G99OHTMwSaQ4wlbkHfGn_69hQvlf11sw1n32wvxbdCgytwpMKyZDm3g=w16
lh3.googleusercontent.com/ 425 B
491 B 76ms
12ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/FG4ErIy91xCYcbduLvglqUSQRCBXDD3G99OHTMwSaQ4wlbkHfGn_69hQvlf11sw1n32wvxbdCgytwpMKyZDm3g=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0401fff68cc29099b3adb39870ada9c2cef6543137b7faf5ad1629c19b6193bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 425
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:30 GMT

GET
H2 200 -LIWOnFZbxKfhaWJJHSKhHHCE7lMK_ER9JQngJS7XhbtcSieuc6zrJMIfDCFYk8V4Pr6V8bZzacCpNdGrbCL=w16
lh3.googleusercontent.com/ 412 B
477 B 75ms
12ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/-LIWOnFZbxKfhaWJJHSKhHHCE7lMK_ER9JQngJS7XhbtcSieuc6zrJMIfDCFYk8V4Pr6V8bZzacCpNdGrbCL=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

2910f7f255ce0eecca4f5a9c795bff79604684aaacca313493f07e88068b8be4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 412
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:30 GMT

GET
H2 200 Tc6DMUYM0t3IClKU7fwPBrfw92h_06RoEX5RRXlncQFG5BeUMAMyM_qcspNv92qKJb_OiAiM1DghBbx3TzsC=w16
lh3.googleusercontent.com/ 419 B
508 B 74ms
11ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/Tc6DMUYM0t3IClKU7fwPBrfw92h_06RoEX5RRXlncQFG5BeUMAMyM_qcspNv92qKJb_OiAiM1DghBbx3TzsC=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b1855b041691c9f1e0d32211f370e19a7e8c56151419f51ccfcd08e4e721d6b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 419
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 09 Apr 2020 18:00:21 GMT

GET
H2 200 zCBCGg93wo14GhReQgRci2U4Pp0OG4x5jDur49aouPLxDTFMC1mUk9B708tGTw679jth_kQ06n815YahSa7bltE=w16
lh3.googleusercontent.com/ 878 B
944 B 73ms
11ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/zCBCGg93wo14GhReQgRci2U4Pp0OG4x5jDur49aouPLxDTFMC1mUk9B708tGTw679jth_kQ06n815YahSa7bltE=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

77adf5c3a5e81f2584fd50347aee2d7904c2fa9ed18d78d273c1f596d80f65d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 878
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:30 GMT

GET
H2 200 n0n_ZxEfo6L0UBdqA6YIIhJ9hiuZ1vpkKq595MUbnF9Wi5cu4p4JYNoBsG7IguV5W4ErzTa5CcsOcOcJD7p1P5g=w16
lh3.googleusercontent.com/ 467 B
533 B 72ms
10ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/n0n_ZxEfo6L0UBdqA6YIIhJ9hiuZ1vpkKq595MUbnF9Wi5cu4p4JYNoBsG7IguV5W4ErzTa5CcsOcOcJD7p1P5g=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

5219bc1a3af13c81b0b6f27fb5425fe59a7262a501f6e0223ba988d1deadd0c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 467
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:30 GMT

GET
H2 200 HJzeukQ39yTqZy5ntzWnH7FqZNB-5nUukrgtJhSTrUEjHQxfCqhjB7k9aGSIvVfiLWAD0hgkVkNOGNXfPwck=w16
lh3.googleusercontent.com/ 432 B
498 B 71ms
9ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/HJzeukQ39yTqZy5ntzWnH7FqZNB-5nUukrgtJhSTrUEjHQxfCqhjB7k9aGSIvVfiLWAD0hgkVkNOGNXfPwck=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ae370c3e52e00b58b4516bae578348391a73e26c6c2f1aaa6843e74d97419e18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 432
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:30 GMT

GET
H2 200 ZGFPcrhyr3OazovWKOGqxPMJmgu5MUWCgvESgTs02NOYUbIconV_lsjO6AmdT_B9xjukv2BofQSWnuoyoNI0=w16
lh3.googleusercontent.com/ 414 B
476 B 78ms
16ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ZGFPcrhyr3OazovWKOGqxPMJmgu5MUWCgvESgTs02NOYUbIconV_lsjO6AmdT_B9xjukv2BofQSWnuoyoNI0=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f4190c156a32550b8a737af08b82f071ae8d5e4c7720f27e966f49d19b430f23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 414
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 09 Apr 2020 18:00:21 GMT

GET
H2 200 EdQWQebpbwUyK7KFop1kfQ6SyNA2cSppOdT01fIamoMmcmMuvc5NcA1OZNmo33VbAa8n8212mHH23JsE05PV=w16
lh3.googleusercontent.com/ 425 B
487 B 78ms
15ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/EdQWQebpbwUyK7KFop1kfQ6SyNA2cSppOdT01fIamoMmcmMuvc5NcA1OZNmo33VbAa8n8212mHH23JsE05PV=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

486904af88f965bff9bf1ca51866928f736c9ebbd7334a6f775f6e2a42237839

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 425
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:30 GMT

GET
H2 200 r7NhF7sfH1PQpohFNToUlq_oa9DJJpCX0UoMbz6Zu4e4I6Dbov7mlLi-LLI83f03mepetzoL0qu-UfFDLDfHrBQ=w16
lh3.googleusercontent.com/ 424 B
486 B 77ms
15ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/r7NhF7sfH1PQpohFNToUlq_oa9DJJpCX0UoMbz6Zu4e4I6Dbov7mlLi-LLI83f03mepetzoL0qu-UfFDLDfHrBQ=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

4910e46f9f91abec7ec724f630c007bd81ee383abfdf6107ed99daabbf2166fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 424
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:30 GMT

GET
H2 200 Z7BWJaFHmaAZgr6erSEZGEreanucQggQ4WBqj7tsobiinDT9AMzmcRrcvWMRqbrOW8G1I6OPljLxGBCnB5SKzg=w16
lh3.googleusercontent.com/ 417 B
483 B 77ms
14ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/Z7BWJaFHmaAZgr6erSEZGEreanucQggQ4WBqj7tsobiinDT9AMzmcRrcvWMRqbrOW8G1I6OPljLxGBCnB5SKzg=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

2ac5a5efa2a76a3974a2a2088833f5fa52b6475f62e46e32c8f3a74930d0635b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 417
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 -VxZl503D7APjOLlKgbRVseHlZrWPORXRfiNglG7a4pzDY7zKhHDUaVLnkG2dluekU--Gd3vvifle527vy0S=w16
lh3.googleusercontent.com/ 410 B
472 B 20ms
14ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/-VxZl503D7APjOLlKgbRVseHlZrWPORXRfiNglG7a4pzDY7zKhHDUaVLnkG2dluekU--Gd3vvifle527vy0S=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

1f9c53f102a037d80b752b9620c0bd32778de68146fe8cc72850029c6116452d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 410
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 TzqLPpdrFgoPI7BgT7ykes2fXK7ygO11S5SUn22L0rfE7SyWsPjMjFZJiP9uFnLBItPH74KlGepJUJqC0AB8Ng=w16
lh3.googleusercontent.com/ 421 B
486 B 19ms
14ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/TzqLPpdrFgoPI7BgT7ykes2fXK7ygO11S5SUn22L0rfE7SyWsPjMjFZJiP9uFnLBItPH74KlGepJUJqC0AB8Ng=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a216d144da43e6be205f02bfe66c5506075ab2f46aa7fe8813c879dcf0d7ef8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 421
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 0xep3Dw-f3uLQzagTKRrrauxghj1pWI_Sqfx8ZNqzoe5UeYttk25BOYUyB0khx06MAtPN8ymfFAO6ew_Xke7DA=w16
lh3.googleusercontent.com/ 424 B
513 B 19ms
13ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/0xep3Dw-f3uLQzagTKRrrauxghj1pWI_Sqfx8ZNqzoe5UeYttk25BOYUyB0khx06MAtPN8ymfFAO6ew_Xke7DA=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

28d0062cfcf833ceb6e2ba0e70546cd08be64c97b7416e0d232c2a42f9b5fa61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 424
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 HUsL_mhLgz8M5mjZtxf7pYHKHTr5WQR5xi2A6p77sHbW2fgUiWx4UBcPh-SyXsYJX3vWPPliQ2SBODzOvOAw2A=w16
lh3.googleusercontent.com/ 200 B
265 B 16ms
13ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/HUsL_mhLgz8M5mjZtxf7pYHKHTr5WQR5xi2A6p77sHbW2fgUiWx4UBcPh-SyXsYJX3vWPPliQ2SBODzOvOAw2A=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d40c6e7630d9d660e5aefd66ca2dbab0714c76a689d68e2576d989e2d525c640

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:18:38 GMT
x-content-type-options: nosniff
age: 42
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 200
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 18 Apr 2020 09:11:54 GMT

GET
H2 200 BzEv7uyhqbIuwGPQJxdZTEvh36nksEIqTnjDrb_lbw0976g-e58LmT0eZXwy_99ZIvQGWIQlEXHJGha2NZwhJP0=w16
lh3.googleusercontent.com/ 4 KB
4 KB 13ms
12ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/BzEv7uyhqbIuwGPQJxdZTEvh36nksEIqTnjDrb_lbw0976g-e58LmT0eZXwy_99ZIvQGWIQlEXHJGha2NZwhJP0=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b7797623c371bea23af3b9ffd9c7596f7fd3746aa9b2d2a8d35ad7d434fb6a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 3596
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:54 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 11ms
11ms Font
font/woff2 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato:300,400,500,700|Roboto:300,400,500,700
Origin: https://go.behindthemarkets.com

Response headers

date: Tue, 14 Apr 2020 23:26:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 553941
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 11016
x-xss-protection: 0
expires: Wed, 14 Apr 2021 23:26:59 GMT

GET
H2 200 yHxsZks5M9V814g5ixp5Z_5tLmLUGWjr2VY4RHPK2fAYbYQo_197RmgbUtG4xm6hC3Uh1VItt7Jue2lYHkI4=w16
lh3.googleusercontent.com/ 230 B
292 B 71ms
68ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/yHxsZks5M9V814g5ixp5Z_5tLmLUGWjr2VY4RHPK2fAYbYQo_197RmgbUtG4xm6hC3Uh1VItt7Jue2lYHkI4=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

bbefc440a5816307b9c792880cb879e8d4bc1605576a028a32b580997937aec7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 230
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 ysrMHEBaPdf8nD2gq9fE9WKwbSE8O83fkUH8vIpTgaanZnlgppqb4lDsoPKOQjdpSMBV179CWZVBRjyqqZwG260=w16
lh3.googleusercontent.com/ 405 B
471 B 70ms
68ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ysrMHEBaPdf8nD2gq9fE9WKwbSE8O83fkUH8vIpTgaanZnlgppqb4lDsoPKOQjdpSMBV179CWZVBRjyqqZwG260=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

38ef131e660f419e8f84145ba5c20b034c004a02acbbf38e54e8d01dd7c56094

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 405
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 H7qUj5DToZ5yVmz_L_I8ONK3I1P-1DQg9QgYejs8Lp2ozfkJSO8kSwrH3kc5tBd4CcjaxJfXxmo_QkS6IDha4w=w16
lh3.googleusercontent.com/ 230 B
315 B 70ms
68ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/H7qUj5DToZ5yVmz_L_I8ONK3I1P-1DQg9QgYejs8Lp2ozfkJSO8kSwrH3kc5tBd4CcjaxJfXxmo_QkS6IDha4w=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

402392ff55e065d9736e979aa2d0320145f1cd505295c125f8d494477827f903

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 230
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Tue, 21 Apr 2020 18:04:22 GMT

GET
H2 200 ZK2SoVlvGI9iDbSVG7_1uY3zj0hENvVNq7PjVCZb6NXIm-IEnMhnLvjtOjeEcvshg1_5agL16QYj4tqWnxVnew=w16
lh3.googleusercontent.com/ 402 B
467 B 69ms
67ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ZK2SoVlvGI9iDbSVG7_1uY3zj0hENvVNq7PjVCZb6NXIm-IEnMhnLvjtOjeEcvshg1_5agL16QYj4tqWnxVnew=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c7158d0e5b29e15788274b0cd48dfd0be1a9fdbf9597e98592aac8c8616395b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 402
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 aYeke8440bZ2OyWrRXNjRwN88kkgO4nRt34R7IwHwew62WU8l7RY2OF9NkfodU8safOd3kHvl13cuRPhlz-2=w16
lh3.googleusercontent.com/ 230 B
295 B 68ms
67ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/aYeke8440bZ2OyWrRXNjRwN88kkgO4nRt34R7IwHwew62WU8l7RY2OF9NkfodU8safOd3kHvl13cuRPhlz-2=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6184695111c8e7f3875bc55ec2179047a9279aadac7ceb414b8823d4b3b2f4c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 230
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 YmqHW-doKJ_v_CoBIB1yqpRMmSMks1VFVnKATiufEj-ywZfm_Om3mP6OWSCQvwRvTRm6NSBl-ddSif6VYpf6=w16
lh3.googleusercontent.com/ 420 B
485 B 10ms
8ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/YmqHW-doKJ_v_CoBIB1yqpRMmSMks1VFVnKATiufEj-ywZfm_Om3mP6OWSCQvwRvTRm6NSBl-ddSif6VYpf6=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f68088617e8b1b9fb27233f7fd10b2b4e0d2a3ed09147404bc3003daada58647

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 420
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 ESgmyR3f5F69BNHZBnzmvL4qEdLVkwNm3E5G0STbzV2mELhc4k6m_m09iM9EA5qhp9s57y6VDhzOdyLu1_gbBf8=w16
lh3.googleusercontent.com/ 412 B
474 B 71ms
69ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ESgmyR3f5F69BNHZBnzmvL4qEdLVkwNm3E5G0STbzV2mELhc4k6m_m09iM9EA5qhp9s57y6VDhzOdyLu1_gbBf8=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0bf8be077100bf737bc0b5e085b34e5ae300e2e3322916ced47a195d38db4f00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 412
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 r4kdt7rQd-SDSaj21geckrWk3qyMcjnDTbOMvvAagwoheR1urr4rrn7omlxcu7a9EzmFyZLymMHMo25YxuppVXk=w16
lh3.googleusercontent.com/ 418 B
484 B 70ms
69ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/r4kdt7rQd-SDSaj21geckrWk3qyMcjnDTbOMvvAagwoheR1urr4rrn7omlxcu7a9EzmFyZLymMHMo25YxuppVXk=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

8f12228eefc76f18a72e0b1e56490493d23163be3c960f5f007ec30ae48ce098

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 418
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 CLuER4WjE4SohKqviflwIUaB45pYMtzzrKRv8XbaYol9RSiHa5qEPv_BQuYKGsZGWvuTw3nF1d7doXsIKLi0=w16
lh3.googleusercontent.com/ 414 B
476 B 70ms
69ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/CLuER4WjE4SohKqviflwIUaB45pYMtzzrKRv8XbaYol9RSiHa5qEPv_BQuYKGsZGWvuTw3nF1d7doXsIKLi0=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

220d7adea4f20bbb86765f656b80124d615c499a8358a4fb25731235f5705ac1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 414
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 kkv59ZXN8Z8cKlRYxqwvObS4x5uNSnqWPBWnR6kxz8fSgJfm-TXLtIzd9XD30px2PCa9TLCMrk7cA5aZSnAT=w16
lh3.googleusercontent.com/ 3 KB
4 KB 12ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/kkv59ZXN8Z8cKlRYxqwvObS4x5uNSnqWPBWnR6kxz8fSgJfm-TXLtIzd9XD30px2PCa9TLCMrk7cA5aZSnAT=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

4ba1b5d4cd361cb5d412a8ef7d19a3fbfed228ccc960445965ac46f128447765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 3544
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:54 GMT

GET
H2 200 F7Q1_8XaYidLrefUWsD_6e9WBuXQ5xnu5fmPKRg4axf379uVWJfB2GZ_-1Ls3W0ugVT3pIBuhD1Pt3g-EoTKFA=w16
lh3.googleusercontent.com/ 3 KB
4 KB 13ms
7ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/F7Q1_8XaYidLrefUWsD_6e9WBuXQ5xnu5fmPKRg4axf379uVWJfB2GZ_-1Ls3W0ugVT3pIBuhD1Pt3g-EoTKFA=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

dba1e27cc488b2588c40882b49a16aab85df2fff9075aa57476cb27bff05d4ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 3569
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:54 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
247 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=458841784766826&ev=PageView&dl=https%3A%2F%2Fgo.behindthemarkets.com%2Fcut-paste-covid%2F%3Fojid%3D653249f20a7c486aa89bd338f65700a6%26utm_source%3D6%26utm_campaign%3D18%26utm_medium%3Dpn%26id%3D1004%26sub2%3Dcovid&rl=&if=false&ts=1587460760273&sw=1600&sh=1200&v=2.9.16&r=stable&ec=0&o=30&fbp=fb.1.1587460760273.1040531964&it=1587460760053&coo=false&rqm=GET

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:19:20 GMT, Tue, 21 Apr 2020 09:19:20 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 21 Apr 2020 09:19:20 GMT

GET
H2 200 G5eARnMwwblcFhCyfzwpAQOmN3FhRYzZMGdoPKOA1W4qbaxz4WNt636WZA6B23qm_iYBOkXk3ArxFmGzZV_yvwI=w16
lh3.googleusercontent.com/ 412 B
474 B 9ms
8ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/G5eARnMwwblcFhCyfzwpAQOmN3FhRYzZMGdoPKOA1W4qbaxz4WNt636WZA6B23qm_iYBOkXk3ArxFmGzZV_yvwI=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

64361c1163ae1b2f074eb160cf75ac4afdde4d203f2e7aca81139e3cd7562ee9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 412
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 cn6jPIS7oKwCInJ3b916fAhHFM_eeQ-Cwo-GU0yQwgIvu6hMYRzqF-K2dLxzAuTrXxPigHlgY0pprEYzYQ-9oCA=w16
lh3.googleusercontent.com/ 399 B
465 B 8ms
7ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/cn6jPIS7oKwCInJ3b916fAhHFM_eeQ-Cwo-GU0yQwgIvu6hMYRzqF-K2dLxzAuTrXxPigHlgY0pprEYzYQ-9oCA=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

97ebadfd110d8a2942c03afc81d824debd1fa71786ade661f570db72481586a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 399
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 EwzQnTAj3FsKgOdbdeZeZB11HyudlZq7x85lF8PpLVx8w4NLNr-3V7867fg0IMJQXeSGLaxUA63M2VoDZ_4JOg=w16
lh3.googleusercontent.com/ 424 B
490 B 7ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/EwzQnTAj3FsKgOdbdeZeZB11HyudlZq7x85lF8PpLVx8w4NLNr-3V7867fg0IMJQXeSGLaxUA63M2VoDZ_4JOg=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

cc9730f2f8bf80e79e4d0abd67bb5ed18ab5df736849dc231fe8aa7858c1b163

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 424
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 en5eQGS7OSwcgI6coS960qCBUmoOvVF9vMcwxy5rK1GKzsnCsseGAoOZF3yl3ijlTPP4aHcM14-J6h7pWjIM5w=w16
lh3.googleusercontent.com/ 399 B
461 B 8ms
7ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/en5eQGS7OSwcgI6coS960qCBUmoOvVF9vMcwxy5rK1GKzsnCsseGAoOZF3yl3ijlTPP4aHcM14-J6h7pWjIM5w=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

dd7806927179eb8e7a44a0197fdf9109449faf723391ffbeb151f056d4f44afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 399
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 OxRkQcXgAdVsmQ_XXaI6Xn25qZwDAgXwydhmfaozUdJyZVxJVxnLM2kyDfx_fc92_W_vRQmVWzRyiHZYKUyFPw=w16
lh3.googleusercontent.com/ 851 B
917 B 12ms
10ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/OxRkQcXgAdVsmQ_XXaI6Xn25qZwDAgXwydhmfaozUdJyZVxJVxnLM2kyDfx_fc92_W_vRQmVWzRyiHZYKUyFPw=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b357a2cde4d094192fadf6415bf186942441bac94a34809037273e237e8883c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 851
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 JZC-KnICfOvdCn-NkWZ7D8dWevfFqyM36s0rtgBhuXIbzwRw7Ys7ewqYoqAW6hF7EW5ePLTNbVu3TTEMRhaaPw=w16
lh3.googleusercontent.com/ 421 B
483 B 11ms
9ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/JZC-KnICfOvdCn-NkWZ7D8dWevfFqyM36s0rtgBhuXIbzwRw7Ys7ewqYoqAW6hF7EW5ePLTNbVu3TTEMRhaaPw=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

99ef2b0b5dcce975caed360ac49d97bea8c77b8e132eaba02004ba2af7826de4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 421
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 0_dOdpZfQ6TbbTqXF4T6AGhz8mXHexaMe7QIz7D9vIu9eB0l6aQwvF6RNqL0TOo6DR5IB4efWU3bQJvwMaIJ=w16
lh3.googleusercontent.com/ 419 B
481 B 11ms
9ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/0_dOdpZfQ6TbbTqXF4T6AGhz8mXHexaMe7QIz7D9vIu9eB0l6aQwvF6RNqL0TOo6DR5IB4efWU3bQJvwMaIJ=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

75ef0b7dad5783fe97577f17fb14c8924f7aa532d5ee8bb64d7d07ef78ddab28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 419
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 AItuMDlWviZeavp01sDiJWsrjDo3zX9wILgbqNyJe46EtnZy4GyLElC2BdeFInlPlXkAfju1NP9d-99Yfs00tg=w16
lh3.googleusercontent.com/ 431 B
493 B 10ms
8ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/AItuMDlWviZeavp01sDiJWsrjDo3zX9wILgbqNyJe46EtnZy4GyLElC2BdeFInlPlXkAfju1NP9d-99Yfs00tg=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ed79d5094af431ece01938c3a29e227133511dfa34de116f33f71ac04bd3145a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 431
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 MC9OLM3nuWmV-LzdxFpU6qQS5FDxFc1DxpEU07tkzfX6kU_Y9xyFhqpexq1fJ_hp3n9YKwZbnPG1XnOiDIvSwQ=w16
lh3.googleusercontent.com/ 688 B
754 B 13ms
11ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/MC9OLM3nuWmV-LzdxFpU6qQS5FDxFc1DxpEU07tkzfX6kU_Y9xyFhqpexq1fJ_hp3n9YKwZbnPG1XnOiDIvSwQ=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

9489d54918d66fcb4ab9933a4be929e664cdde30e81534bde2f5197b4505c6e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 688
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 VW5ASWczL-JDFVjqa50PHYOcDb-QmXWMI0jsqpgVl5Pe7-gf38DjUQn81um63rGwKjAj8XyukKkYyxi0svwD=w16
lh3.googleusercontent.com/ 385 B
451 B 12ms
11ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/VW5ASWczL-JDFVjqa50PHYOcDb-QmXWMI0jsqpgVl5Pe7-gf38DjUQn81um63rGwKjAj8XyukKkYyxi0svwD=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

920ff3a3f33b99d65b6a48630bf3a8d540c2acc64d57b42b77fac96b0bd024b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 385
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 p2O47t3CGWUkWyy5ZPAE0ng4ehil8EKO7BHEt9XvoLT_0NhUxYJNx54tbm8HEGiDAwlHKHeNlGXoDeUD-D9BjA=w16
lh3.googleusercontent.com/ 4 KB
4 KB 51ms
48ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/p2O47t3CGWUkWyy5ZPAE0ng4ehil8EKO7BHEt9XvoLT_0NhUxYJNx54tbm8HEGiDAwlHKHeNlGXoDeUD-D9BjA=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f980e3a363614169bab261b0e340ab5191d5df676505ec1b9a1ef4d85eb11476

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 3621
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:54 GMT

GET
H2 200 RCGjxYTuepjcMb2bA7OSmSyRhC-o1yOAL_BQAOIG2o0DESqlrVUSNiOp6PoaiekkGbK_pWHmpCPONVB2D526=w16
lh3.googleusercontent.com/ 3 KB
4 KB 49ms
48ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/RCGjxYTuepjcMb2bA7OSmSyRhC-o1yOAL_BQAOIG2o0DESqlrVUSNiOp6PoaiekkGbK_pWHmpCPONVB2D526=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ad38e28472c84299cb5bcbea4e155991456973f0c1a690a1b8f2989fbcb29934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:55 GMT
x-content-type-options: nosniff
age: 7165
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 3562
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:54 GMT

GET
H2 200 mnZ5Lf4PIFK1JislIZ3o6kbQgNit6PFTyqOhXZBIkblnERU2sb53K68KsTNtqQ9-cFCyok23vaJyKWXK7nnt=w16
lh3.googleusercontent.com/ 3 KB
4 KB 8ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/mnZ5Lf4PIFK1JislIZ3o6kbQgNit6PFTyqOhXZBIkblnERU2sb53K68KsTNtqQ9-cFCyok23vaJyKWXK7nnt=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f3d6b92111281951cc31f97a38a36a5d33db4e52fdc4c2b0949023201992ad48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 3559
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:54 GMT

GET
H2 200 3i03-UIVjMCEfa1KR1urJ4EaGFOUZOF3MKnVAOLuyZ8d9_-yWT8Efhs50s6zpsDMTPeo--0HUt_MQ71cmWBxkw=w16
lh3.googleusercontent.com/ 433 B
495 B 7ms
7ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/3i03-UIVjMCEfa1KR1urJ4EaGFOUZOF3MKnVAOLuyZ8d9_-yWT8Efhs50s6zpsDMTPeo--0HUt_MQ71cmWBxkw=w16

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c8fbbcf2d0649035388da07bc7dcc853bcb657795b23480f5c69b29d012b0580

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 07:19:56 GMT
x-content-type-options: nosniff
age: 7164
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 433
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Apr 2020 23:36:31 GMT

GET
H2 200 embed.js Show response
static.leadpages.net/leadboxes/current/ 42 KB
15 KB 75ms
53ms Script
application/javascript 2a00:1450:4001:80b::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.leadpages.net/leadboxes/current/embed.js
Requested by: Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80b::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: eab4d4ad96371fd11c5204825006ff6cb5e87e04e089c15eeb59059766424ef1

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:18:37 GMT
content-encoding: gzip
server: Google Frontend
age: 43
etag: "6pn7Vg"
status: 200
content-type: application/javascript
access-control-allow-origin: *
x-cloud-trace-context: 1973f494843cb4aa63c32b8fbd29783f
cache-control: public, max-age=300
content-length: 14834
expires: Tue, 21 Apr 2020 09:23:37 GMT

GET
H2 200 T-3lUZOkr0pGJTg2MtnJnPCAdxJl-PdaWePMpIUm6SACxhH30rYiJ__GYJwtKqQpllM0HVKLGlmwN24gcY3f=w129
lh3.googleusercontent.com/ 4 KB
4 KB 7ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/T-3lUZOkr0pGJTg2MtnJnPCAdxJl-PdaWePMpIUm6SACxhH30rYiJ__GYJwtKqQpllM0HVKLGlmwN24gcY3f=w129

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

90b984cb46a80616456c74500d625c93c46f0afb6ed80ed9b752908930bc622f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 08:33:00 GMT
x-content-type-options: nosniff
age: 2780
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 4382
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 22 Apr 2020 08:33:00 GMT

GET
H2 200 n-SU2QHHlDctT5P7f9PGVlqioYi7pTTg8gvrwvg1ZlSiRL7bP8OT_fgfmJXYifHvL5xQ1K76TrDmpB7-T6cugKs=w832
lh3.googleusercontent.com/ 39 KB
39 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/n-SU2QHHlDctT5P7f9PGVlqioYi7pTTg8gvrwvg1ZlSiRL7bP8OT_fgfmJXYifHvL5xQ1K76TrDmpB7-T6cugKs=w832

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e2d99afe1c68a226e1a03fc1fe359cc2a74039d66249255a9cb5384c2ce7151a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:18:38 GMT
x-content-type-options: nosniff
age: 42
status: 200
content-disposition: inline;filename="unnamed.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 39436
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 22 Apr 2020 09:18:38 GMT

GET
H2 200 tdpih9HNi11Inu5FoM-qMyMwp7Knvga57hIvCWRxynnctJ3skd3Oe7AMGk4UqDpd1FvBCX-upUnBc5zYQGfD=w1585
lh3.googleusercontent.com/ 584 KB
584 KB 9ms
9ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/tdpih9HNi11Inu5FoM-qMyMwp7Knvga57hIvCWRxynnctJ3skd3Oe7AMGk4UqDpd1FvBCX-upUnBc5zYQGfD=w1585

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

7bf827b8cd48a8eda556ae00aabf1b5e998623c8a06418232a6234ebc8464881

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:18:38 GMT
x-content-type-options: nosniff
age: 42
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 597677
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 22 Apr 2020 09:18:38 GMT

GET
H2 200 -ueFME1llxpzXmcTVMXoGVbty4CQL1JV6DV1QZhyjQWOBxlOYKLmpRbmyTUxkeJExrkX_WI1vtMcuW6_Er8_=w1140
lh3.googleusercontent.com/ 916 B
1010 B 8ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/-ueFME1llxpzXmcTVMXoGVbty4CQL1JV6DV1QZhyjQWOBxlOYKLmpRbmyTUxkeJExrkX_WI1vtMcuW6_Er8_=w1140

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

1b8c7695d75a014d757853a89a350ac52080db316ba034b0474108649505c5bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:18:38 GMT
x-content-type-options: nosniff
age: 42
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 916
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 13 Apr 2020 04:01:58 GMT

GET
H2 200 HUsL_mhLgz8M5mjZtxf7pYHKHTr5WQR5xi2A6p77sHbW2fgUiWx4UBcPh-SyXsYJX3vWPPliQ2SBODzOvOAw2A=w1140
lh3.googleusercontent.com/ 917 B
1009 B 7ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/HUsL_mhLgz8M5mjZtxf7pYHKHTr5WQR5xi2A6p77sHbW2fgUiWx4UBcPh-SyXsYJX3vWPPliQ2SBODzOvOAw2A=w1140

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

33a7c4dabe4b2ce8550cf4a8cf34f98aa70a876584b5be0ccc1ddd803c5cad90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:18:38 GMT
x-content-type-options: nosniff
age: 42
status: 200
content-disposition: inline;filename="unnamed.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 917
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 05 Apr 2020 13:50:50 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=458841784766826&ev=Microdata&dl=https%3A%2F%2Fgo.behindthemarkets.com%2Fcut-paste-covid%2F%3Fojid%3D653249f20a7c486aa89bd338f65700a6%26utm_source%3D6%26utm_campaign%3D18%26utm_medium%3Dpn%26id%3D1004%26sub2%3Dcovid&rl=&if=false&ts=1587460760791&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%5C%22Cut%20%26%20Paste%5C%22%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22website%22%2C%22og%3Atitle%22%3A%22%5C%22Cut%20%26%20Paste%5C%22%22%2C%22og%3Adescription%22%3A%22%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fgo.behindthemarkets.com%2Fcut-paste-covid%2F%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.16&r=stable&ec=1&o=30&fbp=fb.1.1587460760273.1040531964&it=1587460760053&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 09:19:20 GMT, Tue, 21 Apr 2020 09:19:20 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 21 Apr 2020 09:19:20 GMT

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=959593418&t=pageview&_s=1&dl=https%3A%2F%2Fgo.behindthemarkets.com%2Fcut-paste-covid%2F%3Fojid%3D653249f20a7c486aa89bd338f65700a6%26utm_sourc...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-102395123-1&cid=1388186900.1587460761&jid=1299418597&_gid=251268692.1587460761&gjid=1013354896&_v=j81&z=580816886

35 B
102 B

21ms
20ms

Image
image/gif

2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-102395123-1&cid=1388186900.1587460761&jid=1299418597&_gid=251268692.1587460761&gjid=1013354896&_v=j81&z=580816886

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 21 Apr 2020 09:19:20 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Apr 2020 09:19:20 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 302
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-102395123-1&cid=1388186900.1587460761&jid=1299418597&_gid=251268692.1587460761&gjid=1013354896&_v=j81&z=580816886
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 419
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
btm-btm-btm.lpages.co/serve-leadbox/bbuMx9RrbckVzBMygBHAXf/ Frame 9E07 0
0 594ms
327ms Document
text/html 35.202.21.90
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://btm-btm-btm.lpages.co/serve-leadbox/bbuMx9RrbckVzBMygBHAXf/?id=1004&ojid=653249f20a7c486aa89bd338f65700a6&sub2=covid

Requested by

Host: static.leadpages.net
URL: https://static.leadpages.net/leadboxes/current/embed.js

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

35.202.21.90 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

90.21.202.35.bc.googleusercontent.com

Software

Leadpages /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

:method: GET
:authority: btm-btm-btm.lpages.co
:scheme: https
:path: /serve-leadbox/bbuMx9RrbckVzBMygBHAXf/?id=1004&ojid=653249f20a7c486aa89bd338f65700a6&sub2=covid
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Response headers

status: 200
date: Tue, 21 Apr 2020 09:19:21 GMT
content-type: text/html
vary: Accept-Encoding
last-modified: Fri, 13 Mar 2020 23:42:40 GMT
etag: W/"ba8bfb0cbaae5543987757d167549984"
x-cache: MISS, HIT
cache-control: no-cache
server: Leadpages
strict-transport-security: max-age=15768000
content-encoding: br

GET
H2 200 /
btm-btm-btm.lpages.co/serve-leadbox/eTJHMHqKHNn2VicLJospKC/ Frame 1376 0
0 504ms
242ms Document
text/html 35.202.21.90
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://btm-btm-btm.lpages.co/serve-leadbox/eTJHMHqKHNn2VicLJospKC/?id=1004&ojid=653249f20a7c486aa89bd338f65700a6&sub2=covid

Requested by

Host: static.leadpages.net
URL: https://static.leadpages.net/leadboxes/current/embed.js

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

35.202.21.90 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

90.21.202.35.bc.googleusercontent.com

Software

Leadpages /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

:method: GET
:authority: btm-btm-btm.lpages.co
:scheme: https
:path: /serve-leadbox/eTJHMHqKHNn2VicLJospKC/?id=1004&ojid=653249f20a7c486aa89bd338f65700a6&sub2=covid
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid

Response headers

status: 200
date: Tue, 21 Apr 2020 09:19:21 GMT
content-type: text/html
vary: Accept-Encoding
last-modified: Fri, 27 Mar 2020 20:40:38 GMT
etag: W/"16967d2d5d18cd9a36a28255feb9c1c9"
x-cache: MISS, HIT
cache-control: no-cache
server: Leadpages
strict-transport-security: max-age=15768000
content-encoding: br

GET
H/1.1 200
OK capture Show response
api.leadpages.io/analytics/v1/events/ 35 B
686 B 395ms
140ms XHR
image/gif 35.192.151.63
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.leadpages.io/analytics/v1/events/capture?k=view&a=leadpage&l=5puEVgccpFLk7zLLWXNJYi&v=&e=&st=&lc=en-US&pid=bb4wMKcXKB896PwqF4vMVT-default-prop&uid=2Ve4xoVWuVqKoyYkhsBBYu&sid=sxHYDcCDuLd6rCD5qFCxPJ&cid=lp-5puEVgccpFLk7zLLWXNJYi&uri=https%3A%2F%2Fgo.behindthemarkets.com%2Fcut-paste-covid%2F%3Fojid%3D653249f20a7c486aa89bd338f65700a6%26utm_source%3D6%26utm_campaign%3D18%26utm_medium%3Dpn%26id%3D1004%26sub2%3Dcovid&rf=&rx=1600&ry=1200&tz=%2B02%3A00
Requested by: Host: js.center.io
URL: https://js.center.io/center.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 35.192.151.63 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 21 Apr 2020 09:19:21 GMT
Server: Stargate
Transfer-Encoding: chunked
X-Forwarded-For: 185.236.201.131
Content-Type: image/gif
access-control-allow-origin: https://go.behindthemarkets.com
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
access-control-max-age: 600
Connection: keep-alive
x-request-id: 05sur116oaid9ofk9vng

GET
H/1.1 200
OK capture Show response
api.leadpages.io/analytics/v1/observations/ 35 B
448 B 442ms
141ms XHR
image/gif 35.192.151.63
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.leadpages.io/analytics/v1/observations/capture?origin=&version=1.2.1&correlateBy=YmEDiqETMDgLKmyqGn9cMA&kind=text,text,timer&label=lb_embed_leadbox_embedded,lb_embed_leadbox_embedded,lb_embed_embed_script_load&value=bbuMx9RrbckVzBMygBHAXf,eTJHMHqKHNn2VicLJospKC,76.08500123023987
Requested by: Host: static.leadpages.net
URL: https://static.leadpages.net/leadboxes/current/embed.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 35.192.151.63 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 21 Apr 2020 09:19:21 GMT
Server: Stargate
Transfer-Encoding: chunked
X-Forwarded-For: 185.236.201.131
Content-Type: image/gif
access-control-allow-origin: https://go.behindthemarkets.com
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
access-control-max-age: 600
Connection: keep-alive
x-request-id: 05t1oqibpnu123e6j6dg

GET
H/1.1 200
OK capture
api.leadpages.io/analytics/v1/observations/ 35 B
357 B 167ms
167ms Image
image/gif 35.192.151.63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.leadpages.io/analytics/v1/observations/capture?version=1.7.13&origin=page-speed&kind=timer,timer,timer,timer,timer,timer,timer,timer,timer,timer&label=domain-lookup,connect,request,ttfb,response,loading,interactive,content-loaded,complete,load&value=1,281,145,427,234,436,985,986,1990,1993
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 35.192.151.63 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 21 Apr 2020 09:19:21 GMT
Server: Stargate
Transfer-Encoding: chunked
X-Forwarded-For: 185.236.201.131
Content-Type: image/gif
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
Connection: keep-alive
x-request-id: 05sur141sgh6ob47u9pg

GET
H/1.1 200
OK capture Show response
api.leadpages.io/analytics/v1/observations/ 35 B
448 B 142ms
142ms XHR
image/gif 35.192.151.63
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.leadpages.io/analytics/v1/observations/capture?origin=&version=1.2.1&correlateBy=YmEDiqETMDgLKmyqGn9cMA&kind=timer,timer&label=lb_embed_leadbox_load,lb_embed_leadbox_load&value=567.9550021886826,626.3650022447109
Requested by: Host: static.leadpages.net
URL: https://static.leadpages.net/leadboxes/current/embed.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 35.192.151.63 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 21 Apr 2020 09:19:22 GMT
Server: Stargate
Transfer-Encoding: chunked
X-Forwarded-For: 185.236.201.131
Content-Type: image/gif
access-control-allow-origin: https://go.behindthemarkets.com
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
access-control-max-age: 600
Connection: keep-alive
x-request-id: 05t1oqksbhoe664h5acg

GET
H/1.1 200
OK capture Show response
api.leadpages.io/analytics/v1/observations/ 35 B
448 B 136ms
136ms XHR
image/gif 35.192.151.63
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.leadpages.io/analytics/v1/observations/capture?version=1.8.6&correlateBy=EBgxeC7EyoSKcpUXb5VRDU&origin=center-js&kind=timer,timer,counter,timer&label=load-center,load-identify,ident-new,send-events&value=42.94000193476677,788.8949997723103,1,396.0699997842312
Requested by: Host: js.center.io
URL: https://js.center.io/center.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 35.192.151.63 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 21 Apr 2020 09:19:25 GMT
Server: Stargate
Transfer-Encoding: chunked
X-Forwarded-For: 185.236.201.131
Content-Type: image/gif
access-control-allow-origin: https://go.behindthemarkets.com
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
access-control-max-age: 600
Connection: keep-alive
x-request-id: 05sur21hv0od1bu70dcg

Verdicts & Comments Add Verdict or Comment

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.behindthemarkets.com/	1970-01-19 08:59:07	Name: _gid Value: GA1.2.251268692.1587460761
.behindthemarkets.com/	1970-01-20 02:28:52	Name: _ga Value: GA1.2.1388186900.1587460761
.behindthemarkets.com/	1970-01-19 08:57:40	Name: _gat_UA-102395123-1 Value: 1
.behindthemarkets.com/	1970-01-19 11:07:16	Name: _fbp Value: fb.1.1587460760273.1040531964

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://go.behindthemarkets.com/cut-paste-covid/?ojid=653249f20a7c486aa89bd338f65700a6&utm_source=6&utm_campaign=18&utm_medium=pn&id=1004&sub2=covid(Line 143) Message: sale ID: 1004

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.leadpages.io
btm-btm-btm.lpages.co
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
go.behindthemarkets.com
js.center.io
lh3.googleusercontent.com
maxcdn.bootstrapcdn.com
s.yimg.com
script.crazyegg.com
sslwidget.criteo.com
static.criteo.net
static.leadpages.net
stats.g.doubleclick.net
tracking.imspublishergroup.com
wba.clqtrk.com
widget.us.criteo.com
www.americanconsumernews.net
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
zpr.io
178.250.0.163
2001:4de0:ac19::1:b:2b
2606:4700::6813:9408
2a00:1288:f03d:1fa::2000
2a00:1450:4001:800::2001
2a00:1450:4001:80b::2013
2a00:1450:4001:815::2008
2a00:1450:4001:816::2003
2a00:1450:4001:819::200e
2a00:1450:4001:824::200a
2a00:1450:400c:c00::9a
2a02:2638:1::3
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.246.99.35
35.192.151.63
35.202.21.90
35.241.23.11
54.174.156.76
67.43.12.232
74.119.119.150
008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420
012baa4613733b5bfae091a6f406ab9dd0545f74eef4a92a5d745b4141efd5e3
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0401fff68cc29099b3adb39870ada9c2cef6543137b7faf5ad1629c19b6193bf
0bf8be077100bf737bc0b5e085b34e5ae300e2e3322916ced47a195d38db4f00
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
198170846b0434afb6882e6fba0ca3ecf89606eac689efeed337d27f58c03ada
1b8c7695d75a014d757853a89a350ac52080db316ba034b0474108649505c5bb
1f8366777ddedf8ffdf8408bc2f9244164b432e1b7c7cb01a082659f36f2226d
1f9c53f102a037d80b752b9620c0bd32778de68146fe8cc72850029c6116452d
220d7adea4f20bbb86765f656b80124d615c499a8358a4fb25731235f5705ac1
28095f1880ca62a37b5b670df1f5181bb0a8c248fd5af1298f5ffa18d11ac28d
28d0062cfcf833ceb6e2ba0e70546cd08be64c97b7416e0d232c2a42f9b5fa61
2910f7f255ce0eecca4f5a9c795bff79604684aaacca313493f07e88068b8be4
2ac5a5efa2a76a3974a2a2088833f5fa52b6475f62e46e32c8f3a74930d0635b
2f220735682253606c6f4b885706516109a48fbd522f9928c717ae7864f0ae8e
33a7c4dabe4b2ce8550cf4a8cf34f98aa70a876584b5be0ccc1ddd803c5cad90
38ef131e660f419e8f84145ba5c20b034c004a02acbbf38e54e8d01dd7c56094
39268815166a0df989060fd89756d058766a8bf6938e1e5ca1cd12d62310994c
402392ff55e065d9736e979aa2d0320145f1cd505295c125f8d494477827f903
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
486904af88f965bff9bf1ca51866928f736c9ebbd7334a6f775f6e2a42237839
4910e46f9f91abec7ec724f630c007bd81ee383abfdf6107ed99daabbf2166fb
4ba1b5d4cd361cb5d412a8ef7d19a3fbfed228ccc960445965ac46f128447765
4c7aade1168b2a14eb1c4fd2d217bb878da063890e6b4f04a67a8c2460589b7c
5219bc1a3af13c81b0b6f27fb5425fe59a7262a501f6e0223ba988d1deadd0c2
5b54138a1228bb354b4d200ba40bca6e8bf05c3476b3013daf8fa8162a414582
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5e39fb322b3255593d8c11d3645744b46c5dfbf12be0afaec1bed9fc8eaca7a1
5eca4f4b5617a6a3340cb0718305f83c846e780b2e6c476bfd65657ccef3f973
6184695111c8e7f3875bc55ec2179047a9279aadac7ceb414b8823d4b3b2f4c9
64361c1163ae1b2f074eb160cf75ac4afdde4d203f2e7aca81139e3cd7562ee9
6999aa983455b07dde377b6a4ed25e2dd10db955692a190f470807f66dac8234
6a60018cab3d38d035188490d869d5dc1283a7dd115917226df457ca92887f7f
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6c571f75d98b23e59a96e177fa3ba9fdac3bafbddbed3cd24a65591193ad382a
75ef0b7dad5783fe97577f17fb14c8924f7aa532d5ee8bb64d7d07ef78ddab28
77adf5c3a5e81f2584fd50347aee2d7904c2fa9ed18d78d273c1f596d80f65d1
78352af71219d6609638a84b754ab583b249f0b9e014c31f5e69825592ef9685
79a11d6064cc9c46c67a278bd868457f6b535fe91bac24fecf4282c45bd47935
7bf827b8cd48a8eda556ae00aabf1b5e998623c8a06418232a6234ebc8464881
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8f12228eefc76f18a72e0b1e56490493d23163be3c960f5f007ec30ae48ce098
90b984cb46a80616456c74500d625c93c46f0afb6ed80ed9b752908930bc622f
920ff3a3f33b99d65b6a48630bf3a8d540c2acc64d57b42b77fac96b0bd024b3
9314e6eba316b602c5f951462309f317ad8198b0f404723ddc8f87bf43a6968c
93ccd8d9abf900853b2be265d860d889f342f4e09946ba3fbe15d0e7269dc249
9489d54918d66fcb4ab9933a4be929e664cdde30e81534bde2f5197b4505c6e2
96f21c60dac45fa2c524e10fc2f10c21a3bb46cbb93c14f7fc26a458209ca6ee
97ebadfd110d8a2942c03afc81d824debd1fa71786ade661f570db72481586a3
99ef2b0b5dcce975caed360ac49d97bea8c77b8e132eaba02004ba2af7826de4
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
a216d144da43e6be205f02bfe66c5506075ab2f46aa7fe8813c879dcf0d7ef8e
ad38e28472c84299cb5bcbea4e155991456973f0c1a690a1b8f2989fbcb29934
ae370c3e52e00b58b4516bae578348391a73e26c6c2f1aaa6843e74d97419e18
b1855b041691c9f1e0d32211f370e19a7e8c56151419f51ccfcd08e4e721d6b4
b357a2cde4d094192fadf6415bf186942441bac94a34809037273e237e8883c8
b6fadd7694e1afed921bafa1c1af6ec642269dc660caf898010cfc0b08159baf
b7797623c371bea23af3b9ffd9c7596f7fd3746aa9b2d2a8d35ad7d434fb6a4b
bbefc440a5816307b9c792880cb879e8d4bc1605576a028a32b580997937aec7
bf11d42a92176d30156ad607f5a14a88a563e8cf7380139da6cf55cf8fdc3492
c7158d0e5b29e15788274b0cd48dfd0be1a9fdbf9597e98592aac8c8616395b9
c8fbbcf2d0649035388da07bc7dcc853bcb657795b23480f5c69b29d012b0580
ca9e28fd55c966b6c32b3488c3d6e460dbcbc66aad630e16c2e76ba2d4374d79
cc08eb3316359de0d8f025efee489da73ca552209a0c9cab6b00894d7fa21d42
cc9730f2f8bf80e79e4d0abd67bb5ed18ab5df736849dc231fe8aa7858c1b163
d40c6e7630d9d660e5aefd66ca2dbab0714c76a689d68e2576d989e2d525c640
dba1e27cc488b2588c40882b49a16aab85df2fff9075aa57476cb27bff05d4ef
dd7806927179eb8e7a44a0197fdf9109449faf723391ffbeb151f056d4f44afd
e2d99afe1c68a226e1a03fc1fe359cc2a74039d66249255a9cb5384c2ce7151a
eab4d4ad96371fd11c5204825006ff6cb5e87e04e089c15eeb59059766424ef1
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ed79d5094af431ece01938c3a29e227133511dfa34de116f33f71ac04bd3145a
f3d6b92111281951cc31f97a38a36a5d33db4e52fdc4c2b0949023201992ad48
f4190c156a32550b8a737af08b82f071ae8d5e4c7720f27e966f49d19b430f23
f68088617e8b1b9fb27233f7fd10b2b4e0d2a3ed09147404bc3003daada58647
f980e3a363614169bab261b0e340ab5191d5df676505ec1b9a1ef4d85eb11476

go.behindthemarkets.com Open in urlscan Pro 35.202.21.90 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

86 Requests

100 %HTTPS

62 %IPv6

22 Domains

23 Subdomains

16 IPs

7 Countries

1107 kBTransfer

2418 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

86 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

go.behindthemarkets.com Open in urlscan Pro
35.202.21.90 Public Scan

Screenshot
Live screenshot

Full Image

86
Requests

100 %
HTTPS

62 %
IPv6

22
Domains

23
Subdomains

16
IPs

7
Countries

1107 kB
Transfer

2418 kB
Size

4
Cookies

86 HTTP transactions
0 data transactions