action.unrefugees.org Open in urlscan Pro
54.200.66.202 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.e.unrefugees.org/?qs=946bf7bc1fa067e817c6cccacad8dfc64e7dce5d4604c414d30f71c609345a8f65a440c5ae2773b18c06f0c4262b...
Effective URL:
https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-upda...
Submission: On September 20 via manual (September 20th 2022, 7:05:25 pm UTC) from IN — Scanned from DE

Summary HTTP 133 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 64 IPs in 8 countries across 51 domains to perform 133 HTTP transactions. The main IP is 54.200.66.202, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is action.unrefugees.org.
TLS certificate: Issued by Amazon on December 8th 2021. Valid for: a year.

This is the only time action.unrefugees.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.111.228.216 13.111.228.216	22606 (EXACT-7) (EXACT-7)
4 8	54.200.66.202 54.200.66.202	16509 (AMAZON-02) (AMAZON-02)
5	2a02:26f0:11a... 2a02:26f0:11a::6867:4841	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	143.204.215.11 143.204.215.11	16509 (AMAZON-02) (AMAZON-02)
9	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
2	52.22.17.73 52.22.17.73	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (STACKPATH...) (STACKPATH-CDN)
1	2606:4700:21:... 2606:4700:21::681b:c258	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	151.101.65.21 151.101.65.21	54113 (FASTLY) (FASTLY)
1	65.9.66.114 65.9.66.114	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:400c:c04::5c	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:11a... 2a02:26f0:11a::6867:4848	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
9	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1 2	142.250.186.134 142.250.186.134	15169 (GOOGLE) (GOOGLE)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2620:116:800d... 2620:116:800d:21:de2e:c7b3:55c0:d5a0	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	3.132.200.162 3.132.200.162	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::2000	10310 (YAHOO-1) (YAHOO-1)
1	35.190.72.228 35.190.72.228	15169 (GOOGLE) (GOOGLE)
1	65.9.66.107 65.9.66.107	16509 (AMAZON-02) (AMAZON-02)
2 2	142.250.185.198 142.250.185.198	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1 1	35.227.237.181 35.227.237.181	15169 (GOOGLE) (GOOGLE)
1 2	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
1	2600:9000:205... 2600:9000:2057:2e00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
1	52.25.243.35 52.25.243.35	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f10... 2a03:2880:f107:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:3200:11:615:7240:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:27::... 2620:1ec:27::cafe:2133	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
3	52.167.85.21 52.167.85.21	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3 5	193.0.160.129 193.0.160.129	54312 (ROCKETFUEL) (ROCKETFUEL)
1	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
1	2600:9000:206... 2600:9000:206e:a000:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	23.22.216.223 23.22.216.223	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1 1	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1 2	185.89.211.116 185.89.211.116	29990 (ASN-APPNEX) (ASN-APPNEX)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	46.51.204.238 46.51.204.238	16509 (AMAZON-02) (AMAZON-02)
1	3.120.214.218 3.120.214.218	16509 (AMAZON-02) (AMAZON-02)
1	2.18.235.93 2.18.235.93	16625 (AKAMAI-AS) (AKAMAI-AS)
1	18.159.84.131 18.159.84.131	16509 (AMAZON-02) (AMAZON-02)
1 1	65.9.66.64 65.9.66.64	16509 (AMAZON-02) (AMAZON-02)
2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	54.84.86.17 54.84.86.17	14618 (AMAZON-AES) (AMAZON-AES)
1 2	104.18.18.126 104.18.18.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.96.159.57 104.96.159.57	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	2600:1f18:612... 2600:1f18:612b:4200:2656:ce7a:55d6:eee3	14618 (AMAZON-AES) (AMAZON-AES)
1	52.59.153.178 52.59.153.178	16509 (AMAZON-02) (AMAZON-02)
1	34.249.119.142 34.249.119.142	16509 (AMAZON-02) (AMAZON-02)
1 2	3.120.20.226 3.120.20.226	16509 (AMAZON-02) (AMAZON-02)
1	151.101.194.49 151.101.194.49	54113 (FASTLY) (FASTLY)
7	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
1 2	20.234.93.27 20.234.93.27	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	162.247.241.14 162.247.241.14	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
133	64

1 13.111.228.216 (United States) 1 redirects

ASN22606 (EXACT-7, US)
PTR: click.e.unrefugees.org

click.e.unrefugees.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 54.200.66.202 (Boardman, United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-200-66-202.us-west-2.compute.amazonaws.com

action.unrefugees.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:11a::6867:4841 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 143.204.215.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-11.fra53.r.cloudfront.net

cdn.unrefugees.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.22.17.73 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-17-73.compute-1.amazonaws.com

www.tfaforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:21::681b:c258 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.plyr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.65.21 (United States)

ASN54113 (FASTLY, US)

www.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.sandbox.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.66.114 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-114.fra56.r.cloudfront.net

static-na.payments-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400c:c04::5c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

pay.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:11a::6867:4848 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f6.1e100.net

4647326.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:de2e:c7b3:55c0:d5a0 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.132.200.162 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-132-200-162.us-east-2.compute.amazonaws.com

collector-3219.tvsquared.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::2000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.72.228 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 228.72.190.35.bc.googleusercontent.com

www.tp88trk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.66.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-107.fra56.r.cloudfront.net

js.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.198 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.237.181 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 181.237.227.35.bc.googleusercontent.com

event.mrtnsvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.248.159 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:2e00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.25.243.35 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-25-243-35.us-west-2.compute.amazonaws.com

lyibja.unrefugees.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f107:83:face:b00c:0:25de (Vienna, Austria)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:3200:11:615:7240:93a1 (United States)

ASN16509 (AMAZON-02, US)

pxl.qccerttest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:27::cafe:2133 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.167.85.21 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

i.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 193.0.160.129 (United States) 3 redirects

ASN54312 (ROCKETFUEL, US)

20668909p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20826429p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::11 (United Kingdom)

ASN56396 (AMOBEE, GB)

r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:a000:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.22.216.223 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-22-216-223.compute-1.amazonaws.com

ad.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.211.116 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.51.204.238 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-46-51-204-238.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.120.214.218 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-214-218.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.159.84.131 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-84-131.eu-central-1.compute.amazonaws.com

bs.serving-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.66.64 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-64.fra56.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.84.86.17 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-84-86-17.compute-1.amazonaws.com

bpi.rtactivate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.18.126 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.96.159.57 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a104-96-159-57.deploy.static.akamaitechnologies.com

x.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Amsterdam, Netherlands) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4200:2656:ce7a:55d6:eee3 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.59.153.178 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-153-178.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.249.119.142 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-119-142.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.120.20.226 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-20-226.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.49 (United States)

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.234.93.27 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.241.14 (United States)

ASN23467 (NEWRELIC-AS-1, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2 pay.google.com — Cisco Umbrella Rank: 2890 adservice.google.com — Cisco Umbrella Rank: 75 region1.analytics.google.com — Cisco Umbrella Rank: 5636 play.google.com — Cisco Umbrella Rank: 24	423 KB
14	unrefugees.org 5 redirects click.e.unrefugees.org action.unrefugees.org cdn.unrefugees.org lyibja.unrefugees.org	690 KB
12	gstatic.com www.gstatic.com fonts.gstatic.com	787 KB
11	doubleclick.net 4 redirects 4647326.fls.doubleclick.net ad.doubleclick.net — Cisco Umbrella Rank: 178 stats.g.doubleclick.net — Cisco Umbrella Rank: 79 googleads.g.doubleclick.net — Cisco Umbrella Rank: 41 cm.g.doubleclick.net — Cisco Umbrella Rank: 210	5 KB
9	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	40 KB
7	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 557 i.clarity.ms — Cisco Umbrella Rank: 5269 c.clarity.ms — Cisco Umbrella Rank: 998	26 KB
6	google.de adservice.google.de — Cisco Umbrella Rank: 9081 www.google.de — Cisco Umbrella Rank: 6352	2 KB
6	typekit.net use.typekit.net — Cisco Umbrella Rank: 430 p.typekit.net — Cisco Umbrella Rank: 577	131 KB
5	rfihub.com 3 redirects 20668909p.rfihub.com 20826429p.rfihub.com a.rfihub.com — Cisco Umbrella Rank: 2958 p.rfihub.com — Cisco Umbrella Rank: 728	7 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 375 c.bing.com — Cisco Umbrella Rank: 220	13 KB
3	paypal.com www.paypal.com — Cisco Umbrella Rank: 2582 www.sandbox.paypal.com — Cisco Umbrella Rank: 45725	95 KB
2	bidswitch.net 1 redirects x.bidswitch.net — Cisco Umbrella Rank: 301	1 KB
2	spotxchange.com 1 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 563	1 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 528	2 KB
2	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 331	107 B
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 208	2 KB
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 228	2 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	315 B
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 436	588 B
2	ipredictive.com js.ipredictive.com — Cisco Umbrella Rank: 121815 ad.ipredictive.com — Cisco Umbrella Rank: 5887	3 KB
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 480	7 KB
2	tvsquared.com collector-3219.tvsquared.com	9 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 152	168 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 905 pixel.quantserve.com — Cisco Umbrella Rank: 423	11 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	169 KB
2	tfaforms.com www.tfaforms.com — Cisco Umbrella Rank: 66905	68 KB
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 215	620 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 326	14 KB
1	everesttech.net sync-tm.everesttech.net — Cisco Umbrella Rank: 562	177 B
1	krxd.net beacon.krxd.net — Cisco Umbrella Rank: 513	339 B
1	agkn.com aa.agkn.com — Cisco Umbrella Rank: 448	377 B
1	tremorhub.com partners.tremorhub.com — Cisco Umbrella Rank: 1070	183 B
1	addthis.com x.dlx.addthis.com — Cisco Umbrella Rank: 1196	191 B
1	rtactivate.com bpi.rtactivate.com — Cisco Umbrella Rank: 2089	109 B
1	rezync.com 1 redirects live.rezync.com — Cisco Umbrella Rank: 1752	780 B
1	serving-sys.com bs.serving-sys.com — Cisco Umbrella Rank: 1209	105 B
1	media.net contextual.media.net — Cisco Umbrella Rank: 559	616 B
1	eyeota.net ps.eyeota.net — Cisco Umbrella Rank: 961	344 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 335	239 B
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 5521	6 KB
1	turn.com r.turn.com — Cisco Umbrella Rank: 3229	398 B
1	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1244	632 B
1	qccerttest.com pxl.qccerttest.com — Cisco Umbrella Rank: 983	550 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 40	984 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 846	1 KB
1	mrtnsvr.com 1 redirects event.mrtnsvr.com — Cisco Umbrella Rank: 50662	247 B
1	tp88trk.com www.tp88trk.com — Cisco Umbrella Rank: 22253	18 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 128	16 KB
1	payments-amazon.com static-na.payments-amazon.com — Cisco Umbrella Rank: 14534	22 KB
1	plyr.io cdn.plyr.io — Cisco Umbrella Rank: 14197	32 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 654	30 KB
133	51

	Domain	Requested by
11	www.gstatic.com	www.google.com www.gstatic.com pay.google.com
9	www.google-analytics.com	www.googletagmanager.com action.unrefugees.org www.gstatic.com www.google-analytics.com
9	www.google.com	action.unrefugees.org www.gstatic.com www.google.com
8	action.unrefugees.org	4 redirects action.unrefugees.org
7	play.google.com	www.gstatic.com
5	www.google.de	action.unrefugees.org
5	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
5	use.typekit.net	action.unrefugees.org use.typekit.net
4	pay.google.com	action.unrefugees.org pay.google.com www.gstatic.com
4	cdn.unrefugees.org	action.unrefugees.org
3	i.clarity.ms	www.clarity.ms
3	bat.bing.com	www.googletagmanager.com bat.bing.com action.unrefugees.org
2	www.sandbox.paypal.com	www.paypal.com
2	c.clarity.ms	1 redirects
2	x.bidswitch.net	1 redirects
2	sync.search.spotxchange.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects action.unrefugees.org
2	idsync.rlcdn.com	action.unrefugees.org
2	p.rfihub.com	2 redirects
2	dpm.demdex.net	1 redirects
2	ib.adnxs.com	1 redirects action.unrefugees.org
2	www.clarity.ms	bat.bing.com www.clarity.ms
2	www.facebook.com	action.unrefugees.org
2	region1.analytics.google.com	www.googletagmanager.com
2	pixel.tapad.com	1 redirects action.unrefugees.org
2	adservice.google.com	1 redirects 4647326.fls.doubleclick.net
2	ad.doubleclick.net	2 redirects
2	s.yimg.com	action.unrefugees.org s.yimg.com
2	collector-3219.tvsquared.com	action.unrefugees.org
2	connect.facebook.net	action.unrefugees.org connect.facebook.net
2	4647326.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.googletagmanager.com	action.unrefugees.org www.googletagmanager.com
2	www.tfaforms.com	action.unrefugees.org
1	bam.nr-data.net	js-agent.newrelic.com
1	c.bing.com	1 redirects
1	js-agent.newrelic.com	action.unrefugees.org
1	sync-tm.everesttech.net	action.unrefugees.org
1	beacon.krxd.net	action.unrefugees.org
1	aa.agkn.com	action.unrefugees.org
1	partners.tremorhub.com	action.unrefugees.org
1	x.dlx.addthis.com	action.unrefugees.org
1	bpi.rtactivate.com	action.unrefugees.org
1	live.rezync.com	1 redirects
1	bs.serving-sys.com	action.unrefugees.org
1	contextual.media.net	action.unrefugees.org
1	ps.eyeota.net	action.unrefugees.org
1	pixel.rubiconproject.com	action.unrefugees.org
1	a.rfihub.com	action.unrefugees.org
1	cm.g.doubleclick.net	1 redirects
1	fonts.gstatic.com	www.google.com
1	20826429p.rfihub.com	c1.rfihub.net
1	ad.ipredictive.com	js.ipredictive.com
1	c1.rfihub.net	action.unrefugees.org
1	r.turn.com	action.unrefugees.org
1	20668909p.rfihub.com	1 redirects
1	sp.analytics.yahoo.com	action.unrefugees.org
1	googleads.g.doubleclick.net	www.googleadservices.com
1	pixel.quantserve.com	action.unrefugees.org
1	pxl.qccerttest.com	action.unrefugees.org
1	fonts.googleapis.com	action.unrefugees.org
1	lyibja.unrefugees.org	connect.facebook.net
1	rules.quantcount.com	secure.quantserve.com
1	event.mrtnsvr.com	1 redirects
1	adservice.google.de	action.unrefugees.org
1	js.ipredictive.com	www.googletagmanager.com
1	www.tp88trk.com	www.googletagmanager.com
1	secure.quantserve.com	action.unrefugees.org
1	www.googleadservices.com	www.googletagmanager.com
1	p.typekit.net	use.typekit.net
1	static-na.payments-amazon.com	action.unrefugees.org
1	www.paypal.com	action.unrefugees.org
1	cdn.plyr.io	action.unrefugees.org
1	code.jquery.com	action.unrefugees.org
1	click.e.unrefugees.org	1 redirects
133	74

This site contains links to these domains. Also see Links.

Domain
www.tfaforms.com
www.unrefugees.org
www.facebook.com
twitter.com
www.youtube.com
instagram.com

Subject Issuer	Validity	Valid
unrefugees.org Amazon	`2021-12-08` - `2023-01-05`	a year	crt.sh
use.typekit.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-09-14` - `2023-10-15`	a year	crt.sh
*.unrefugees.org Amazon	`2022-05-06` - `2023-06-04`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-08-29` - `2022-11-21`	3 months	crt.sh
*.tfaforms.com Amazon	`2022-05-16` - `2023-06-14`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
*.plyr.io GTS CA 1P5	`2022-09-02` - `2022-12-01`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2022-04-12` - `2023-04-12`	a year	crt.sh
static-na.payments-amazon.com Amazon	`2022-06-22` - `2023-07-21`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-29` - `2022-11-21`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-08-29` - `2022-11-21`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2022-09-03` - `2023-03-03`	6 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-06-30` - `2022-09-28`	3 months	crt.sh
*.tvsquared.com Amazon	`2022-08-16` - `2023-09-13`	a year	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-09-05` - `2022-10-26`	2 months	crt.sh
tp88trk.com Starfield Secure Certificate Authority - G2	`2022-02-15` - `2023-02-15`	a year	crt.sh
*.ipredictive.com Amazon	`2022-04-13` - `2023-05-12`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-29` - `2022-11-21`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-08-29` - `2022-11-21`	3 months	crt.sh
lyibja.unrefugees.org R3	`2022-07-23` - `2022-10-21`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-29` - `2022-11-21`	3 months	crt.sh
qccerttest.com Amazon	`2022-04-04` - `2023-05-03`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2022-02-27` - `2023-02-27`	a year	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-08-09` - `2023-02-01`	6 months	crt.sh
*.google.de GTS CA 1C3	`2022-08-29` - `2022-11-21`	3 months	crt.sh
a.clarity.ms Microsoft Azure TLS Issuing CA 02	`2022-06-07` - `2023-06-02`	a year	crt.sh
*.rfihub.net Amazon	`2021-12-29` - `2023-01-27`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2022-05-24` - `2023-05-24`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2022-02-20` - `2023-02-22`	a year	crt.sh
bs.serving-sys.com Amazon	`2022-04-10` - `2023-05-09`	a year	crt.sh
rtactivate.com Amazon	`2022-04-13` - `2023-05-12`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
odc-pixel-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2022-02-26` - `2023-03-01`	a year	crt.sh
*.tremorhub.com Amazon	`2022-03-24` - `2023-04-22`	a year	crt.sh
*.agkn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-09-06` - `2023-09-21`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-03` - `2022-11-02`	a year	crt.sh
*.everesttech.net GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-02-03` - `2023-03-07`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-07-10` - `2023-08-11`	a year	crt.sh
www.sandbox.paypal.com DigiCert SHA2 Extended Validation Server CA	`2022-02-08` - `2023-03-11`	a year	crt.sh
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1	`2022-01-10` - `2023-02-10`	a year	crt.sh

This page contains 8 frames:

Primary Page: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Frame ID: 3A96600292E5D8ED94EE6A6FC4D99459
Requests: 85 HTTP requests in this frame

Frame: https://4647326.fls.doubleclick.net/activityi;dc_pre=CNno55CIpPoCFTlKkQUdjBkAVg;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=620289379.1663700714;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU
Frame ID: 28B025BDE6113F2A09DEC3627198B987
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 1B7773FE108E4FABBDF9CAAE3AF8EA47
Requests: 1 HTTP requests in this frame

Frame: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Faction.unrefugees.org&mid=
Frame ID: C1A3AF7487EEA0CBE4324E3C740AE0FE
Requests: 12 HTTP requests in this frame

Frame: https://ad.ipredictive.com/d/track/event?upid=101374&cache_buster=1663700715&url=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU
Frame ID: 74731E2D19C025E20CE2E5707E6CCBAB
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfMg_EaAAAAAMhDNLMlgqDChzmtYHlx1yU2y7GI&co=aHR0cHM6Ly9hY3Rpb24udW5yZWZ1Z2Vlcy5vcmc6NDQz&hl=en&v=zmiYzsHi8INTJBWt2QZC9aM5&theme=light&size=normal&cb=rrw7f7dnku7s
Frame ID: 5A428E3BFB0DE5C518D26117AC8660D9
Requests: 8 HTTP requests in this frame

Frame: https://20826429p.rfihub.com/ca.html?ver=9&rb=9587&ca=20826429&_o=9587&_t=20826429&pe=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&pf=&ra=3636986014801098
Frame ID: DE0FFF31E1CF2BDE24EE8EB6FB3D3A39
Requests: 19 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=zmiYzsHi8INTJBWt2QZC9aM5&k=6LfMg_EaAAAAAMhDNLMlgqDChzmtYHlx1yU2y7GI
Frame ID: A09B64AB3C6AD51DE1B9728EC64553A9
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign Now: Stand with families seeking asylum at the U.S. southern border | USA for UNHCR

Page URL History Show full URLs

https://click.e.unrefugees.org/?qs=946bf7bc1fa067e817c6cccacad8dfc64e7dce5d4604c414d30f71c609345a8f65a440c5... HTTP 302
http://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF... HTTP 301
https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF... Page URL

Detected technologies

Plyr (Video players) Expand

Overall confidence: 100%
Detected patterns

https://cdn\.plyr\.io/([0-9.]+)/.+\.js

Google Pay (Payment processors) Expand

Overall confidence: 100%
Detected patterns

pay\.google\.com/([a-z/]+)/pay\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Sizmek (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

serving-sys\.com/

Typekit (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+use\.typekit\.(?:net|com)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

133
Requests

89 %
HTTPS

43 %
IPv6

51
Domains

74
Subdomains

64
IPs

8
Countries

2795 kB
Transfer

6995 kB
Size

61
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.tfaforms.com/forms/help/4671150
Title: Contact Information

Search URL Search Domain Scan URL

URL: https://www.unrefugees.org/privacy-policy/
Title: Privacy Policy. Text STOP to opt-out or HELP for more info. No purchase necessary. Message & Data Rates May Apply.

Search URL Search Domain Scan URL

URL: https://www.facebook.com/UNREFUGEES
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/UNRefugeeAgency
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/USAforUNHCR
Title: Youtube

Search URL Search Domain Scan URL

URL: https://instagram.com/usaforunhcr
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.unrefugees.org/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.e.unrefugees.org/?qs=946bf7bc1fa067e817c6cccacad8dfc64e7dce5d4604c414d30f71c609345a8f65a440c5ae2773b18c06f0c4262bf79d296f5643bc7eb031 HTTP 302
http://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU HTTP 301
https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://action.unrefugees.org/img/unhcr-visibility-horizontal-white-cmyk-v2016.svg HTTP 301
https://cdn.unrefugees.org/u4uweb2020/img/unhcr-visibility-horizontal-white-cmyk-v2016.svg

Request Chain 8

https://action.unrefugees.org/img/unhcr-visibility-horizontal-blue-cmyk-v2016.svg HTTP 301
https://cdn.unrefugees.org/u4uweb2020/img/unhcr-visibility-horizontal-blue-cmyk-v2016.svg

Request Chain 9

https://action.unrefugees.org/img/search-icon-white.png HTTP 301
https://cdn.unrefugees.org/u4uweb2020/img/search-icon-white.png

Request Chain 21

https://4647326.fls.doubleclick.net/activityi;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=620289379.1663700714;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU HTTP 302
https://4647326.fls.doubleclick.net/activityi;dc_pre=CNno55CIpPoCFTlKkQUdjBkAVg;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=620289379.1663700714;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU

Request Chain 30

https://ad.doubleclick.net/ddm/activity/src=4269937;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=4269937;dc_pre=CLeK3JCIpPoCFRbLOwId9GoNBQ;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
https://adservice.google.com/ddm/fls/p/src=4269937;dc_pre=CLeK3JCIpPoCFRbLOwId9GoNBQ;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;~oref=https://action.unrefugees.org/title42-petition-adv-email-2022/%3Futm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU HTTP 302
https://adservice.google.de/ddm/fls/p/src=4269937;dc_pre=CLeK3JCIpPoCFRbLOwId9GoNBQ;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;~oref=https://action.unrefugees.org/title42-petition-adv-email-2022/%3Futm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU

Request Chain 31

https://event.mrtnsvr.com/?adv=17114&cb=502103755&ref=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&gtmcb=1585130694 HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=t1J1Qsfap HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3203&partner_device_id=t1J1Qsfap

Request Chain 73

https://20668909p.rfihub.com/ca.gif?rb=9587&ca=20668909&ra=74281357 HTTP 302
https://r.turn.com/r/beacon?b2=2ktLc5k8nNM07yj6GA-Hrn8gtUS_nFcwtDx5qaA26AoeU_Oup029YVIprkeGvqSpoIUReErvK66MTKJfORKOtg&cid=

Request Chain 89

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTE0MjMzNjcxOTkyMDEzNDAwOA==&forward= HTTP 302
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESELpk61ZRmM5Rtvf_7Ad_W5Q&google_cver=1

Request Chain 90

https://ib.adnxs.com/setuid?entity=18&code=5142336719920134008 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D5142336719920134008

Request Chain 92

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5142336719920134008&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5142336719920134008&redir=

Request Chain 93

https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
https://ps.eyeota.net/match?uid=5142336719920134008&bid=omt9pi0

Request Chain 96

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5142336719920134008&referrer=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=02efb0c8-33e2-4b10-8d28-03f636b6d8e4%3A1663700719.6252806&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D02efb0c8-33e2-4b10-8d28-03f636b6d8e4%253A1663700719.6252806 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=02efb0c8-33e2-4b10-8d28-03f636b6d8e4%3A1663700719.6252806

Request Chain 98

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336719920134008&forward= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336719920134008&forward=&C=1

Request Chain 101

https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336719920134008&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336719920134008&img=1&__user_check__=1&sync_id=2ba01a9a-3917-11ed-9181-143d56a10306

Request Chain 105

https://x.bidswitch.net/sync?dsp_id=119&user_id=5142336719920134008&expires=30 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5142336719920134008&expires=30

Request Chain 122

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=9DFCF1E4792649AA9803FFCE1FD72801&RedC=c.clarity.ms&MXFR=10C51AD02869647C1A8408F52C696AB8 HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=9DFCF1E4792649AA9803FFCE1FD72801&MUID=232E2DF4D99866F31C433FD1D834673E

133 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
action.unrefugees.org/title42-petition-adv-email-2022/
Redirect Chain

https://click.e.unrefugees.org/?qs=946bf7bc1fa067e817c6cccacad8dfc64e7dce5d4604c414d30f71c609345a8f65a440c5ae2773b18c06f0c4262bf79d296f5643bc7eb031
http://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_on...
https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_o...

40 KB
14 KB

1968ms
1574ms

Document
text/html

54.200.66.202
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.200.66.202 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-200-66-202.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 3e58ba4183513ddd7218be6232686b424a74a54a41bfbfe96358029ed758260c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private
content-encoding: gzip
content-length: 14174
content-type: text/html; charset=utf-8
date: Tue, 20 Sep 2022 19:05:13 GMT
vary: Accept-Encoding

Redirect headers

Connection: keep-alive
Content-Length: 617
Content-Type: text/html; charset=UTF-8
Date: Tue, 20 Sep 2022 19:05:11 GMT
Location: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Server: Microsoft-IIS/10.0

GET
H2 200 index.css
action.unrefugees.org/css/ 203 KB
33 KB 183ms
182ms Stylesheet
text/css 54.200.66.202
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://action.unrefugees.org/css/index.css?v=0
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.200.66.202 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-200-66-202.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: bd10041b6aabbb41f44207a8cc8c60b4b1b57be240fae710053455fb2d6fc46f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:13 GMT
content-encoding: gzip
last-modified: Tue, 31 May 2022 16:01:34 GMT
etag: "08340b3775d81:0"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 32998

GET
H2 200 plyr.css
action.unrefugees.org/css/ 24 KB
5 KB 181ms
180ms Stylesheet
text/css 54.200.66.202
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://action.unrefugees.org/css/plyr.css
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.200.66.202 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-200-66-202.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 465ecd3c27cf42a3309af6bda6e2b8c4b9cb7a78788908904e0d6761a2c3102a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:13 GMT
content-encoding: gzip
last-modified: Tue, 31 May 2022 16:01:34 GMT
etag: "08340b3775d81:0"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 4215

GET
H2 200 hrp3szy.css
use.typekit.net/ 7 KB
1 KB 70ms
26ms Stylesheet
text/css 2a02:26f0:11a::6867:4841
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/hrp3szy.css

Requested by

Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:11a::6867:4841 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

7cb56da908e94235a698c35dac8162e57993bfceefba669afddc29bd866b97f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
server: nginx
date: Tue, 20 Sep 2022 19:05:13 GMT
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1032

GET
H/1.1 200
OK title42-header-fam-rf1193413x1440.jpg
cdn.unrefugees.org/u4uweb2020/media/0uebod2x/ 139 KB
140 KB 260ms
18ms Image
image/jpeg 143.204.215.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.unrefugees.org/u4uweb2020/media/0uebod2x/title42-header-fam-rf1193413x1440.jpg
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-11.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cdeefb36cfc07c7d117078771fbc3eeaa918025a369ab1c92de84b35d03c9f88

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 18:33:10 GMT
Via: 1.1 110641d379117242a91443ac729d6dee.cloudfront.net (CloudFront)
Age: 1924
X-Cache: Hit from cloudfront
Connection: keep-alive
x-amz-meta-local-date-created: 133034058767192137
Content-Length: 142674
x-amz-meta-local-date-modified: 133034058767192137
Last-Modified: Wed, 27 Jul 2022 14:33:43 GMT
Server: AmazonS3
ETag: "c2fa411f3446c32dd03ac58a0ec3757c"
Content-Type: image/jpeg
Cache-Control: public,max-age=2592000
X-Amz-Cf-Pop: FRA53-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: EXY07eKy3oo7EKUTbt0uUE_4p5TSm2Yw2LqLy8r0cwAZTkCWVTpJeA==

GET
H2 200 enterprise.js Show response
www.google.com/recaptcha/ 1006 B
684 B 50ms
21ms Script
text/javascript 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?onload=gCaptchaReadyCallback&render=explicit&hl=en_US

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

853bcc9a357f2f04e005b3bfcc614e10788ba9d5d0089482b9da1b84f6206ffa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 615
x-xss-protection: 1; mode=block
expires: Tue, 20 Sep 2022 19:05:13 GMT

GET
H2 200 wforms.js Show response
www.tfaforms.com/wForms/3.11/js/ 207 KB
64 KB 440ms
198ms Script
application/javascript 52.22.17.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tfaforms.com/wForms/3.11/js/wforms.js?v=1663700712

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.17.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-17-73.compute-1.amazonaws.com

Software

nginx /

Resource Hash

2be4c1816230ce629f009339ad2fd712c2b6962f7cff1c9ddd0020a54ee649ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
content-encoding: gzip
last-modified: Tue, 13 Sep 2022 19:43:55 GMT
server: nginx
etag: W/"6320dd7b-33ace"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
x-fa-app: ecs-143-250

GET
H2 200 localization-en_US.js Show response
www.tfaforms.com/wForms/3.11/js/ 7 KB
3 KB 343ms
101ms Script
application/javascript 52.22.17.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tfaforms.com/wForms/3.11/js/localization-en_US.js?v=1663700712

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.17.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-17-73.compute-1.amazonaws.com

Software

nginx /

Resource Hash

546b29c0d58453484fe0efe4e8715a16f88594ce3ec85ac598e2d1a065347df4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
content-encoding: gzip
last-modified: Tue, 13 Sep 2022 19:34:28 GMT
server: nginx
etag: W/"6320db44-1a0b"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
x-fa-app: ecs-166-104

GET
H/1.1

200
OK

unhcr-visibility-horizontal-white-cmyk-v2016.svg
cdn.unrefugees.org/u4uweb2020/img/
Redirect Chain

https://action.unrefugees.org/img/unhcr-visibility-horizontal-white-cmyk-v2016.svg
https://cdn.unrefugees.org/u4uweb2020/img/unhcr-visibility-horizontal-white-cmyk-v2016.svg

12 KB
5 KB

39ms
11ms

Image
image/svg+xml

143.204.215.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.unrefugees.org/u4uweb2020/img/unhcr-visibility-horizontal-white-cmyk-v2016.svg
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: HTTP/1.1
Server: 143.204.215.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-11.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6bfbae61daf6218548d35bd824d5299e6f0517f156050c302ddd83fa0e8abdc8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 03:23:21 GMT
Content-Encoding: gzip
Age: 56514
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
x-amz-meta-local-date-created: 132296392572169450
x-amz-meta-local-date-modified: 131539295639031921
Last-Modified: Thu, 04 Jun 2020 18:07:00 GMT
Server: AmazonS3
ETag: W/"589ecfd0bcfdf4d702240ce70983f8fe"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Via: 1.1 110641d379117242a91443ac729d6dee.cloudfront.net (CloudFront)
Cache-Control: public,max-age=2592000
X-Amz-Cf-Pop: FRA53-C1
X-Amz-Cf-Id: VRFUZeYPlWxM102ZcjvBLQqlsoD9LYITjVitZLSiUBpCwWTmHMTYow==

Redirect headers

location: https://cdn.unrefugees.org/u4uweb2020/img/unhcr-visibility-horizontal-white-cmyk-v2016.svg
date: Tue, 20 Sep 2022 19:05:13 GMT
cache-control: no-cache
server: Microsoft-IIS/10.0
content-length: 213
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

unhcr-visibility-horizontal-blue-cmyk-v2016.svg
cdn.unrefugees.org/u4uweb2020/img/
Redirect Chain

https://action.unrefugees.org/img/unhcr-visibility-horizontal-blue-cmyk-v2016.svg
https://cdn.unrefugees.org/u4uweb2020/img/unhcr-visibility-horizontal-blue-cmyk-v2016.svg

12 KB
5 KB

13ms
12ms

Image
image/svg+xml

143.204.215.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.unrefugees.org/u4uweb2020/img/unhcr-visibility-horizontal-blue-cmyk-v2016.svg
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: HTTP/1.1
Server: 143.204.215.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-11.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e9027cbc9f2efbff37e09740f41c16a1ffd89eae8f1555f6a5955d3198d9c31d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 04:44:52 GMT
Content-Encoding: gzip
Age: 51623
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
x-amz-meta-local-date-created: 132296392572149491
x-amz-meta-local-date-modified: 131539295413995338
Last-Modified: Thu, 04 Jun 2020 18:06:29 GMT
Server: AmazonS3
ETag: W/"e2c31e589985c6c3dab41cf627244301"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Via: 1.1 110641d379117242a91443ac729d6dee.cloudfront.net (CloudFront)
Cache-Control: public,max-age=2592000
X-Amz-Cf-Pop: FRA53-C1
X-Amz-Cf-Id: 1ZzTRT2mTX-71Jcd-d-WJvO6E6yxFsPfvtUUTy2tckzvRy--AZLkxg==

Redirect headers

location: https://cdn.unrefugees.org/u4uweb2020/img/unhcr-visibility-horizontal-blue-cmyk-v2016.svg
date: Tue, 20 Sep 2022 19:05:13 GMT
cache-control: no-cache
server: Microsoft-IIS/10.0
content-length: 212
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

search-icon-white.png
cdn.unrefugees.org/u4uweb2020/img/
Redirect Chain

https://action.unrefugees.org/img/search-icon-white.png
https://cdn.unrefugees.org/u4uweb2020/img/search-icon-white.png

1 KB
2 KB

26ms
13ms

Image
image/png

143.204.215.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.unrefugees.org/u4uweb2020/img/search-icon-white.png
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: HTTP/1.1
Server: 143.204.215.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-11.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cc41b89e82e346d38089fb2b430ff6c1864aa655f0c5003abc35d45d8b7bb1f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 05:27:08 GMT
Via: 1.1 110641d379117242a91443ac729d6dee.cloudfront.net (CloudFront)
Age: 49087
X-Cache: Hit from cloudfront
Connection: keep-alive
x-amz-meta-local-date-created: 132296392572099450
Content-Length: 1477
x-amz-meta-local-date-modified: 132267732062509912
Last-Modified: Wed, 25 Mar 2020 20:14:47 GMT
Server: AmazonS3
ETag: "799989474245d817e252ae409682a467"
Content-Type: image/png
Cache-Control: public,max-age=2592000
X-Amz-Cf-Pop: FRA53-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: 3iV2XVzIwWZLTeYFswTEnJLToCnq5373hanyeaIRYro2w-pHV-MTLw==

Redirect headers

location: https://cdn.unrefugees.org/u4uweb2020/img/search-icon-white.png
date: Tue, 20 Sep 2022 19:05:13 GMT
cache-control: no-cache
server: Microsoft-IIS/10.0
content-length: 186
content-type: text/html; charset=UTF-8

GET
H2 200 jquery-3.4.1.min.js Show response
code.jquery.com/ 86 KB
30 KB 630ms
552ms Script
application/javascript 2001:4de0:ac18::1:a:2b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.1.min.js
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Origin: https://action.unrefugees.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
content-encoding: gzip
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
etag: W/"28feccc0-15851"
vary: Accept-Encoding
x-hw: 1663700714.dop131.fr8.t,1663700714.cds057.fr8.hn,1663700714.cds261.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30638

GET
H2 200 plyr.js Show response
cdn.plyr.io/3.5.2/ 111 KB
32 KB 94ms
37ms Script
application/javascript 2606:4700:21::681b:c258
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plyr.io/3.5.2/plyr.js
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:21::681b:c258 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8608c7129a24079dd332403d0aef583dcefdf0bfc02914d626a6559a3ac049ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:13 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 28467638
cf-polished: origSize=113855
x-cache: HIT, MISS
x-cache-hits: 1, 0
access-control-allow-methods: GET, POST, OPTIONS
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: TZRW07NHA7HDTQRF
x-amz-id-2: 0qccXalry3H9NUZk5iINdmb9FQHElfmnxeKLy7LVwAVig3i9Gki/t70YUD6pD2bnXZIP6sxx1i0=
x-served-by: cache-dca12921-DCA, cache-lcy19283-LCY
last-modified: Sun, 24 Feb 2019 01:08:29 GMT
server: cloudflare
x-timer: S1635233075.277599,VS0,VE79
etag: W/"26d009457000af80d7306229fc132b15"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XIZDZt8sukKxhNu4kI%2Fj71oMQEr6pemUT%2BPDVxkump%2BMnyKZ4QpoY4qQOn5En%2BjXZSaVPOrVg55cmGhruCHia20IF3hGADJ5lvoh%2B73AHcHlPrFH84qCqhG9amjT3jk4DS7QMPvXnRrE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Date, Cache-Control, Content-Type, Accept, Origin, Accept
cache-control: max-age=31536000
cf-ray: 74dcd4d62e027511-LHR
cf-bgj: minify

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
969 B 49ms
20ms Script
text/javascript 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

64869176015533649b3a7ddb21322dfc9c47a3e55d80218655bd30b4cc22a684

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 556
x-xss-protection: 1; mode=block
expires: Tue, 20 Sep 2022 19:05:13 GMT

GET
H2 200 js Show response
www.paypal.com/sdk/ 313 KB
94 KB 109ms
31ms Script
application/javascript 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/sdk/js?client-id=AXR8B71wtnEZHnlsTiphl1IRoxz4ZCoV5P4_FBhZeyaRBbGZXlD1_VE1c9hd2asTUQGyWBo7nyZo-_Mi&vault=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3646ba424a243eced19cd620a49975600163535c9196bf2e5d89a035ea255adf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; script-src 'nonce-Xdcvcf+tEbTtw5C5AY71LCL1BKXy4AEowYJHVVs7DNPqGmL9' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'nonce-Xdcvcf+tEbTtw5C5AY71LCL1BKXy4AEowYJHVVs7DNPqGmL9' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-Xdcvcf+tEbTtw5C5AY71LCL1BKXy4AEowYJHVVs7DNPqGmL9' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-Xdcvcf+tEbTtw5C5AY71LCL1BKXy4AEowYJHVVs7DNPqGmL9' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-encoding: gzip
x-content-type-options: nosniff
age: 2607
x-cache: HIT
p3p: true
paypal-debug-id: f9474906f69a5
server-timing: "traceparent;desc="00-0000000000000000000f9474906f69a5-8019a781426c2f49-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 94818
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4064-HHN
access-control-allow-origin: *
traceparent: 00-0000000000000000000f9474906f69a5-3dbc8aedc02f2bf5-01
x-timer: S1663700714.978904,VS0,VE2
x-frame-options: SAMEORIGIN
date: Tue, 20 Sep 2022 19:05:13 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
access-control-expose-headers: Server-Timing
cache-control: public, max-age=3600, s-maxage=10800
etag: W/"17262-Vm7wlQctu/MXI2Cs+8og1H45OoI"
accept-ranges: bytes
x-cache-hits: 2

GET
H2 200 checkout.js Show response
static-na.payments-amazon.com/ 79 KB
22 KB 67ms
12ms Script
application/javascript 65.9.66.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-na.payments-amazon.com/checkout.js
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-114.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 46ecb79454ead6331e674b2eb63126f4dc947268e662863f42a3e6fdc494f115

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-amz-version-id: yt6nrEAR6kxaN6Ovviu.V_IjcB.YRVvn
content-encoding: br
last-modified: Wed, 14 Sep 2022 10:22:07 GMT
server: AmazonS3
age: 525
etag: W/"bc9cf433deb54b37d24739747c5071ac"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 58c21e16c9e093deb494fbb4de260efa.cloudfront.net (CloudFront)
cache-control: max-age=1200,public
date: Tue, 20 Sep 2022 18:58:15 GMT
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: Eac0WYeFDik90FKtNVqrYnArjpWnQnwjmI76U55cdDujuIBNiIcB5A==

GET
H2 200 index.min.js Show response
action.unrefugees.org/scripts/lib/ 756 KB
485 KB 516ms
510ms Script
application/javascript 54.200.66.202
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://action.unrefugees.org/scripts/lib/index.min.js?v=0
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.200.66.202 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-200-66-202.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: ec9ce281ea2b68a78bb11994bbda11df71edf8fc8a15ba80c945bf0f4f708848

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:13 GMT
content-encoding: gzip
last-modified: Wed, 01 Jun 2022 13:40:18 GMT
etag: "04d9321bd75d81:0"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 495105

GET
H2 200 pay.js Show response
pay.google.com/gp/p/js/ 101 KB
33 KB 150ms
66ms Script
application/javascript 2a00:1450:400c:c04::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/js/pay.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::5c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

71a4954bfc82b7512ffe6f4c8a53e763a37157f399c94b13b2fe4bd423b5e86e

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport, script-src 'report-sample' 'nonce-unv2mPRi1b8P6yN7wZB9sQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: private, max-age=600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport, script-src 'report-sample' 'nonce-unv2mPRi1b8P6yN7wZB9sQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist
expires: Tue, 20 Sep 2022 19:05:13 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 319 KB
94 KB 83ms
37ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-XT4L

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b2d4cd9636fffaedb0624257ca78b11f3abee42db7072400e8f4042e7cfd711d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95289
x-xss-protection: 0
last-modified: Tue, 20 Sep 2022 18:15:09 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 20 Sep 2022 19:05:14 GMT

GET
H2 200 p.css
p.typekit.net/ 5 B
195 B 68ms
18ms Stylesheet
text/css 2a02:26f0:11a::6867:4848
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=hrp3szy&ht=tk&f=139.140.171.173.174.175.176.15701.15703.15705.15708&a=1630018&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/hrp3szy.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4848 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://use.typekit.net/hrp3szy.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 20 Sep 2022 19:05:13 GMT
last-modified: Sat, 16 Oct 2021 08:18:43 GMT
server: nginx
etag: "616a8ae3-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 268ms
12ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-XT4L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 194
date: Tue, 20 Sep 2022 19:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 20 Sep 2022 21:02:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
16 KB 365ms
63ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-XT4L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

7bcbe327243628310e84027b85bca98a20d208f66f64685d979c6ccfa587d2d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15697
x-xss-protection: 0
server: cafe
etag: 1764007376392519731
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 20 Sep 2022 19:05:14 GMT

GET
H3

200

activityi;dc_pre=CNno55CIpPoCFTlKkQUdjBkAVg;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=620289379.1663700714;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A%2... Show response
4647326.fls.doubleclick.net/ Frame 28B0
Redirect Chain

https://4647326.fls.doubleclick.net/activityi;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=620289379.1663700714;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A...
https://4647326.fls.doubleclick.net/activityi;dc_pre=CNno55CIpPoCFTlKkQUdjBkAVg;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=620289379.1663700714;u20=%2Ftitle42-petitio...

912 B
524 B

82ms
56ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4647326.fls.doubleclick.net/activityi;dc_pre=CNno55CIpPoCFTlKkQUdjBkAVg;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=620289379.1663700714;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-XT4L

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f6.1e100.net

Software

cafe /

Resource Hash

e2745418333b88f0f9fdf29ca587b55aff361a219a1e1196adacffcd4c47fe69

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 499
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 20 Sep 2022 19:05:14 GMT
expires: Tue, 20 Sep 2022 19:05:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 20 Sep 2022 19:05:14 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://4647326.fls.doubleclick.net/activityi;dc_pre=CNno55CIpPoCFTlKkQUdjBkAVg;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=620289379.1663700714;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 308ms
34ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-XT4L

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Thu, 28 Jul 2022 17:32:37 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9DB964BA993B459FAEB25B43EE255CCD Ref B: FRA31EDGE0115 Ref C: 2022-09-20T19:05:14Z
etag: "80a8697a8a2d81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
date: Tue, 20 Sep 2022 19:05:14 GMT
accept-ranges: bytes
content-length: 11367

GET
H2 200 aquant.js Show response
secure.quantserve.com/ 26 KB
10 KB 72ms
24ms Script
application/javascript 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/aquant.js?a=p-SLcBYqRUU3yLq
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 34686cba28b7d374710a0b8204ae2cbce77ced594bcac71bef4f5260a8d99745

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
content-encoding: gzip
etag: "eN3sxSgaav0x5wHLxGB1gQ=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Tue, 27 Sep 2022 19:05:14 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 101 KB
27 KB 46ms
11ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

844bfb2ff3311ad9b5611b51d8c72e0c483a8ceafe7c625a5c321637f9277399

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26839
x-xss-protection: 0
pragma: public
x-fb-debug: crzlJXut6hZrB9avw8lHA096u2kBpDX+te2AgTypXZT4MAyyVy2a12sQPnXzTygKdfMXDEbGRDibgPjCw+uLpw==
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 20 Sep 2022 19:05:14 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK tv2track.js Show response
collector-3219.tvsquared.com/ 20 KB
9 KB 692ms
343ms Script
application/javascript 3.132.200.162
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-3219.tvsquared.com/tv2track.js
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.132.200.162 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-132-200-162.us-east-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 19:05:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 Aug 2022 10:12:59 GMT
Server: nginx
ETag: "6305f9ab-2133"
Content-Type: application/javascript
Cache-Control: max-age=600
Connection: keep-alive
X-Robots-Tag: noindex
Content-Length: 8499
Expires: Tue, 20 Sep 2022 19:15:14 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 16 KB
6 KB 321ms
30ms Script
application/javascript 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 18:54:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 620
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5929
x-amz-id-2: koWYdhHtfmQJRUIdsBOcjfqE20Vrq2Yw0xzx0dZeCrIRVKJbYbV2mJsx+nT2+OO0vkE+KRXISMc=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Jun 2022 12:21:31 GMT
server: ATS
etag: "6a624022b5d271dcefb070b0b6670abc-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: C1CJCPFS0RK0SKA1
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: .QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 everflow.js Show response
www.tp88trk.com/scripts/sdk/ 58 KB
18 KB 856ms
115ms Script
text/javascript 35.190.72.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tp88trk.com/scripts/sdk/everflow.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-XT4L
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.72.228 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 228.72.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2a72806e7ecf829960274016cfa7c3b84dd3f89fbba960f8e0e2b2fddfa743df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:15 GMT
via: 1.1 google
server: nginx
vary: Origin
content-type: text/javascript
content-encoding: gzip
cache-control: max-age=14400
x-eflow-request-id: 61f637d6-67f8-4dfc-9f34-d77bba657b7c
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 adelphic_universal_pixel.js Show response
js.ipredictive.com/ 2 KB
2 KB 57ms
9ms Script
application/javascript 65.9.66.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.ipredictive.com/adelphic_universal_pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-XT4L
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-107.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 35e56359a3010d1973d3505a00c79e1cef65219cbf6f74d0516ba255bad73be1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 18:15:36 GMT
via: 1.1 a618edcb8ddcdae59a3a61a6c82ff54c.cloudfront.net (CloudFront)
last-modified: Mon, 11 Jul 2022 21:29:04 GMT
server: AmazonS3
age: 3003
etag: "36055609c37d02bc38f0ee7bdf901af4"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 1897
x-amz-cf-id: MX9-VzSlh1_96-w7EFVgBlGlgg58mLG8nWTRtPGAKbNVLcfGROrfBw==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 218 KB
75 KB 47ms
30ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-P9YZZV758Y&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-XT4L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

99d51d558fc1c0945ae19933dd77debe55eb982b7838972110cfdec4b633ea63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 76977
x-xss-protection: 0
expires: Tue, 20 Sep 2022 19:05:14 GMT

GET
H2

200

%3Futm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU
adservice.google.de/ddm/fls/p/src=4269937;dc_pre=CLeK3JCIpPoCFRbLOwId9GoNBQ;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;~oref=https://action.unrefug...
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=4269937;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://ad.doubleclick.net/ddm/activity/src=4269937;dc_pre=CLeK3JCIpPoCFRbLOwId9GoNBQ;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://adservice.google.com/ddm/fls/p/src=4269937;dc_pre=CLeK3JCIpPoCFRbLOwId9GoNBQ;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;~oref=https://actio...
https://adservice.google.de/ddm/fls/p/src=4269937;dc_pre=CLeK3JCIpPoCFRbLOwId9GoNBQ;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;~oref=https://action...

42 B
737 B

197ms
50ms

Image
image/gif

2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.de/ddm/fls/p/src=4269937;dc_pre=CLeK3JCIpPoCFRbLOwId9GoNBQ;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;~oref=https://action.unrefugees.org/title42-petition-adv-email-2022/%3Futm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU

Requested by

Protocol

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://adservice.google.de/ddm/fls/p/src=4269937;dc_pre=CLeK3JCIpPoCFRbLOwId9GoNBQ;type=invmedia;cat=unhcr0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;~oref=https://action.unrefugees.org/title42-petition-adv-email-2022/%3Futm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_cid%3D0031K00003CjI07QAF%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://event.mrtnsvr.com/?adv=17114&cb=502103755&ref=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u...
https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=t1J1Qsfap
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3203&partner_device_id=t1J1Qsfap

95 B
113 B

34ms
20ms

Image
image/png

35.227.248.159
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3203&partner_device_id=t1J1Qsfap

Requested by

Protocol

Server

35.227.248.159 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

159.248.227.35.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
via: 1.1 google
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3203&partner_device_id=t1J1Qsfap
date: Tue, 20 Sep 2022 19:05:14 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 200 rules-p-SLcBYqRUU3yLq.js Show response
rules.quantcount.com/ 2 KB
1 KB 58ms
10ms Script
application/javascript 2600:9000:2057:2e00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-SLcBYqRUU3yLq.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/aquant.js?a=p-SLcBYqRUU3yLq
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:2e00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5618595d9e8a507cd2220456357bca005b987f2d0f1379a476ddf064cb9c0f10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:02:31 GMT
content-encoding: gzip
age: 2151
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
last-modified: Mon, 29 Aug 2022 01:01:42 GMT
server: AmazonS3
etag: W/"80fc8fe9970380d1f1d0d5cd50585663"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: HHMiP5WfPHTt7pRNrmN-NzLPockfefCox4jBkastlTYLUvasIvu6pw==

POST
H2 204 collect
region1.analytics.google.com/g/ 0
351 B 526ms
16ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-P9YZZV758Y&gtm=2oe9j0&_p=2009918982&_gaz=1&cid=1350372577.1663700714&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1663700714&sct=1&seg=0&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&dt=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P9YZZV758Y&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://action.unrefugees.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 80ms
80ms Ping
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-P9YZZV758Y&cid=1350372577.1663700714&gtm=2oe9j0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P9YZZV758Y&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://action.unrefugees.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 78ms
50ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-P9YZZV758Y&cid=1350372577.1663700714&gtm=2oe9j0&aip=1&z=735003672

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 363860773806760 Show response
connect.facebook.net/signals/config/ 479 KB
141 KB 28ms
14ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/363860773806760?v=2.9.83&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6bc64e1dcd1d00c6730b2d5cd95c6f6ff679d1659003d0afa0a55611b6c25f89

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 144606
x-xss-protection: 0
pragma: public
x-fb-debug: t8mzTScycbbQitkCDatXGW9/NBEfdncDHa2Akhb5oKifdpYE3VbpixjWa8b1qis0aASTDJRUeeg1qC+4htF+Ng==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 20 Sep 2022 19:05:14 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 events Show response
lyibja.unrefugees.org/ 0
167 B 770ms
171ms XHR
text/plain 52.25.243.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lyibja.unrefugees.org/events

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/signals/config/363860773806760?v=2.9.83&r=stable

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.25.243.35 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-25-243-35.us-west-2.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://action.unrefugees.org
date: Tue, 20 Sep 2022 19:05:15 GMT
access-control-allow-credentials: true
vary: origin
content-length: 0
strict-transport-security: max-age=15724800; includeSubDomains

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 138ms
103ms Image
image/gif 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=363860773806760&ev=PageView&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D_removed_%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26_filteredParams%3D%257B%2522unwantedParams%2522%253A%255B%2522utm_cid%2522%255D%252C%2522sensitiveParams%2522%253A%255B%255D%257D&rl=&if=false&ts=1663700714378&sw=1600&sh=1200&v=2.9.83&r=stable&ec=0&o=30&fbp=fb.1.1663700714374.1711627554&eid=ob3_plugin-set_9c1bde94fd9d676b5eb769e1ebc7c735418cd5d02132ca147a85adb8467907d0&it=1663700714271&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Tue, 20 Sep 2022 19:05:14 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
443 B 111ms
68ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-3754388-9%20UA-3754388-9&cid=1350372577.1663700714&jid=1325597966&gjid=774008944&_gid=1501666799.1663700714&_u=YCDAiAABBAAAAE~&z=1339122013

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 20 Sep 2022 19:05:14 GMT
content-type: text/plain
access-control-allow-origin: https://action.unrefugees.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
72 B 106ms
68ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-1473340-18&cid=1350372577.1663700714&jid=703673122&gjid=1446507793&_gid=1501666799.1663700714&_u=YCHAiAABBAAAAE~&z=1341002080

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 20 Sep 2022 19:05:14 GMT
content-type: text/plain
access-control-allow-origin: https://action.unrefugees.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 102ms
69ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-3754388-9&cid=1350372577.1663700714&jid=468752586&gjid=1824913130&_gid=1501666799.1663700714&_u=YCHAiAABBAAAAE~&z=960574620

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 20 Sep 2022 19:05:14 GMT
content-type: text/plain
access-control-allow-origin: https://action.unrefugees.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 27ms
9ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=2009918982&t=pageview&_s=1&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&ul=en-us&de=UTF-8&dt=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiAABB~&jid=1325597966&gjid=774008944&cid=1350372577.1663700714&tid=UA-3754388-9%20UA-3754388-9&_gid=1501666799.1663700714&gtm=2wg9j0XT4L&cd5=GTM-XT4L_251&cd6=GTM-XT4L&z=2071650958

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 12:40:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23093
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 28ms
9ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=2009918982&t=pageview&_s=1&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&ul=en-us&de=UTF-8&dt=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCHAiAABBAAAAE~&jid=703673122&gjid=1446507793&cid=1350372577.1663700714&tid=UA-1473340-18&_gid=1501666799.1663700714&gtm=2wg9j0XT4L&cd5=GTM-XT4L_251&cd6=GTM-XT4L&cd3=USA&z=448717280

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 12:40:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23093
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 29ms
10ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=2009918982&t=pageview&_s=1&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&ul=en-us&de=UTF-8&dt=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCHAiAABBAAAAE~&jid=468752586&gjid=1824913130&cid=1350372577.1663700714&tid=UA-3754388-9&_gid=1501666799.1663700714&gtm=2wg9j0XT4L&cd1=7011K0000023NwSQAU&cd2=7011K0000023NwXQAU&z=1092232037

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 12:40:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23093
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
984 B 50ms
21ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Kalam|Lato&display=swap

Requested by

Host: action.unrefugees.org
URL: https://action.unrefugees.org/css/index.css?v=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d08c52cc003c28f266bcdf1924c340b183c1f32fb96da57550f6973f5fbe50a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/css/index.css?v=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 20 Sep 2022 19:01:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 20 Sep 2022 19:05:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 20 Sep 2022 19:05:14 GMT

GET
H2 200 pixel
pxl.qccerttest.com/ 35 B
550 B 87ms
44ms Image
image/gif 2600:9000:214f:3200:11:615:7240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pxl.qccerttest.com/pixel?r=1160196907;fpan=1;fpa=P0-1282475969-1663700714421;pbc=;ns=0;ce=1;qjs=1;qv=d18171e5-20220913105912;ref=;cm=;gdpr=0;d=unrefugees.org;dst=0;et=1663700714421;tzo=0;url=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU;ogl=title.Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U%252ES%252E%20southern%20border%20%7C%20USA%20f%2Ctype.website%2Curl.https%3A%2F%2Faction%252Eunrefugees%252Eorg%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26%2Cimage.https%3A%2F%2Fcdn%252Eunrefugees%252Eorg%2Fu4uweb2020%2Fmedia%2Fx3bkyle1%2Ftitle42-og-fam-rf1193413x12%2Cdescription.As%20the%20number%20of%20people%20forced%20to%20flee%20is%20growing%20by%20the%20day%252C%20it%E2%80%99s%20crucial%20that%20

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:3200:11:615:7240:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 02:11:33 GMT
via: 1.1 a75b67932d84d80b40e12159613deb16.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 62186
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000
content-length: 35
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 04 Aug 2022 16:01:04 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: "55d25e9dc950d5db4d53a3b195c046c6"
vary: Accept-Encoding, Origin
content-type: image/gif
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
x-amz-cf-id: aaPjjuF-x50rf4LRhyypW6fLrwYK1NxfkNb67nv_A09JmYRsPn81bw==

GET
H2 200 pixel;r=577005910;labels=_fp.event.Default;rf=0;a=p-SLcBYqRUU3yLq;url=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26...
pixel.quantserve.com/ 35 B
371 B 24ms
15ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=577005910;labels=_fp.event.Default;rf=0;a=p-SLcBYqRUU3yLq;url=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU;uht=2;fpan=0;fpa=P0-1282475969-1663700714421;pbc=;ns=0;ce=1;qjs=1;qv=d18171e5-20220913105912;cm=;gdpr=0;ref=;d=unrefugees.org;dst=0;et=1663700714425;tzo=0;ogl=title.Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U%252ES%252E%20southern%20border%20%7C%20USA%20f%2Ctype.website%2Curl.https%3A%2F%2Faction%252Eunrefugees%252Eorg%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26%2Cimage.https%3A%2F%2Fcdn%252Eunrefugees%252Eorg%2Fu4uweb2020%2Fmedia%2Fx3bkyle1%2Ftitle42-og-fam-rf1193413x12%2Cdescription.As%20the%20number%20of%20people%20forced%20to%20flee%20is%20growing%20by%20the%20day%252C%20it%E2%80%99s%20crucial%20that%20;ses=237de572-7646-4cba-b106-96a8857711b8

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 5612726.js Show response
bat.bing.com/p/action/ 1 KB
843 B 187ms
186ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5612726.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0b98f9f666599d18f83e72683b9bf54591c01af7dbfffceda491f2dc59195b51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 95568CE00A51416686182F969E647B3E Ref B: FRA31EDGE0115 Ref C: 2022-09-20T19:05:14Z
date: Tue, 20 Sep 2022 19:05:14 GMT
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private,max-age=60
content-length: 666

GET
H2 200 10095779.json Show response
s.yimg.com/wi/config/ 46 B
679 B 406ms
128ms XHR
application/json 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10095779.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

81f701abbdb3dcd7318338357add41af96a3b776549dc928c4703cf1cf9f2ffe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:15 GMT
x-content-type-options: nosniff
age: 0
x-amz-server-side-encryption: AES256
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: 6BVGWNKFB2RRBWYN
x-amz-id-2: 7+ZreRRH5oljtXcGYx0NvUk82lNNn6WNIiA3Tb6QFOXFdv6ETdwHglPtxLAZy9Y/VUxDghu71UU=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 20 Oct 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 14 Sep 2022 20:58:25 GMT
server: ATS
etag: "ca96ec3516187adbafe0fb0d4f2e4932"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-version-id: AO6OvHycU6oPxWJjvTRCjyjUvfXH8wEk
access-control-allow-origin: *
x-xss-protection: 1; mode=block
content-length: 46
content-type: application/json

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/957115417/ 3 KB
2 KB 535ms
64ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/957115417/?random=1663700714455&cv=9&fst=1663700714455&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg9j0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&tiba=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&auid=620289379.1663700714&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14792c9a2a7e42d3e4f3a80f80ac3fb8a89db5959ce714ba5b3e525acd2da20e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1245
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 l
use.typekit.net/af/925423/00000000000000003b9b038f/27/ 19 KB
20 KB 120ms
70ms Font
application/font-woff2 2a02:26f0:11a::6867:4841
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/925423/00000000000000003b9b038f/27/l?subset_id=2&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/hrp3szy.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4841 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 7c707b4d486575fcdf35497e30073fd70f0a9ea072e4ca1ca724da7fbab22a9b

Request headers

Referer: https://use.typekit.net/hrp3szy.css
Origin: https://action.unrefugees.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
server: nginx
etag: "af967ea1356382090341795946181a15b4b5bcf0"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 19900

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/ 388 KB
155 KB 439ms
10ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?onload=gCaptchaReadyCallback&render=explicit&hl=en_US

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d94d48861ea4d1585e765d393147dafc3df44e3f33a2150b944bca4815cf9e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Origin: https://action.unrefugees.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 16:13:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10290
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 157726
x-xss-protection: 0
last-modified: Wed, 14 Sep 2022 00:24:01 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Sep 2023 16:13:44 GMT

GET
H2 200 l
use.typekit.net/af/180254/00000000000000000001522c/27/ 45 KB
46 KB 93ms
70ms Font
application/font-woff2 2a02:26f0:11a::6867:4841
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/180254/00000000000000000001522c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/hrp3szy.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4841 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 38c9c1413e17c7a5ee87095bdb4cad0da069451ee937cb801c8f37f2c734644f

Request headers

Referer: https://use.typekit.net/hrp3szy.css
Origin: https://action.unrefugees.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
server: nginx
etag: "d8f0e75543cc417069e2148d573e1b3687264d73"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 46404

GET
H2 200 l
use.typekit.net/af/220823/000000000000000000015231/27/ 45 KB
45 KB 49ms
31ms Font
application/font-woff2 2a02:26f0:11a::6867:4841
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/220823/000000000000000000015231/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/hrp3szy.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4841 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 73ef385046533349dbdb6264bfdb814819b44a3a7ddeedf7611db7d55f567c7c

Request headers

Referer: https://use.typekit.net/hrp3szy.css
Origin: https://action.unrefugees.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
server: nginx
etag: "25d9000ed11ad93413dd9fab416a1870c8ae46cd"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 46076

GET
H2 200 l
use.typekit.net/af/8e11d4/00000000000000003b9b038c/27/ 19 KB
19 KB 88ms
70ms Font
application/font-woff2 2a02:26f0:11a::6867:4841
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/8e11d4/00000000000000003b9b038c/27/l?subset_id=2&fvd=n6&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/hrp3szy.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4841 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 62c0466b6e78094d8bb9b9fb50f13f3eb39e3be88dce7663ecfbcabde18b64bc

Request headers

Referer: https://use.typekit.net/hrp3szy.css
Origin: https://action.unrefugees.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
server: nginx
etag: "50fb462bb968fa8996b7f205254cfa92e534ea41"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 19600

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
296 B 352ms
50ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-1473340-18&cid=1350372577.1663700714&jid=703673122&_u=YCHAiAABBAAAAE~&z=1981238751

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 350ms
46ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-1473340-18&cid=1350372577.1663700714&jid=703673122&_u=YCHAiAABBAAAAE~&z=1981238751

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 354ms
51ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3754388-9&cid=1350372577.1663700714&jid=468752586&_u=YCHAiAABBAAAAE~&z=1772888695

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 352ms
48ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3754388-9&cid=1350372577.1663700714&jid=468752586&_u=YCHAiAABBAAAAE~&z=1772888695

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/ 391 KB
156 KB 398ms
20ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9337f499c9b0cc63404026b5448c6fd449df6ed57abf148722751a3a4b992c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Origin: https://action.unrefugees.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 18:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 943
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 159646
x-xss-protection: 0
last-modified: Wed, 14 Sep 2022 00:24:01 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Sep 2023 18:49:31 GMT

GET
H2 200 5612726 Show response
www.clarity.ms/tag/uet/ 2 KB
2 KB 444ms
109ms Script
application/x-javascript 2620:1ec:27::cafe:2133
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/5612726
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/5612726.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:27::cafe:2133 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 5ac302a7b4a4114b8b21685bf9bbd8871e41beb806a89a4f18f78549a1e00ef5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:14 GMT
x-powered-by: ASP.NET
x-azure-ref: 06g4qYwAAAAB9QaXbUA0CT5+uzaSPeGp9UFJBRURHRTEzMTIANmNmYmVlZTAtNTAyNy00ODRiLTg5NjctNGEyOWFmNzdmMWUx
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
request-context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
content-length: 1589
expires: -1

GET
H/1.1 200
OK tv2track.php
collector-3219.tvsquared.com/ 42 B
276 B 104ms
104ms Image
image/gif 3.132.200.162
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collector-3219.tvsquared.com/tv2track.php?action_name=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&idsite=TV-63728109-1&rec=1&r=740814&h=19&m=5&s=14&url=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&_id=d8a69bdffbc38b22&_idts=1663700715&_idvc=0&_idn=1&_viewts=&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=1585
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.132.200.162 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-132-200-162.us-east-2.compute.amazonaws.com
Software: nginx /
Resource Hash: f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 19:05:14 GMT
Server: nginx
Connection: keep-alive
Request-Id: 84afe89f-6ff8-4dd5-89c2-bc6fc1378c15
P3p: CP='OTI DSP COR NID STP UNI OTPa OUR'
Content-Length: 42
Content-Type: image/gif

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
632 B 134ms
31ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Tue%2C%2020%20Sep%202022%2019%3A05%3A14%20GMT&n=0&b=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&.yp=10095779&f=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&enc=UTF-8&yv=1.13.0&tagmgr=gtm

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:14 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Tue, 20 Sep 2022 19:05:14 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 1B77 0
18 B 33ms
15ms Document
text/plain 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://action.unrefugees.org
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://action.unrefugees.org
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Tue, 20 Sep 2022 19:05:14 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 /
www.google.com/pagead/1p-user-list/957115417/ 42 B
64 B 62ms
61ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/957115417/?random=1663700714455&cv=9&fst=1663700400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg9j0&sendb=1&frm=0&url=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&tiba=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&async=1&fmt=3&is_vtc=1&random=814271844&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/957115417/ 42 B
64 B 27ms
25ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/957115417/?random=1663700714455&cv=9&fst=1663700400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg9j0&sendb=1&frm=0&url=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&tiba=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&async=1&fmt=3&is_vtc=1&random=814271844&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pre=CNno55CIpPoCFTlKkQUdjBkAVg;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=*;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A%2F%2Faction.unrefugees.org%2Ft...
adservice.google.com/ddm/fls/z/ Frame 28B0 42 B
63 B 86ms
59ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNno55CIpPoCFTlKkQUdjBkAVg;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=*;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU

Requested by

Host: 4647326.fls.doubleclick.net
URL: https://4647326.fls.doubleclick.net/activityi;dc_pre=CNno55CIpPoCFTlKkQUdjBkAVg;src=4647326;type=unrefcms;cat=cmsvist;ord=2624990577048;gtm=2wg9j0;auiddc=620289379.1663700714;u20=%2Ftitle42-petition-adv-email-2022%2F;~oref=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4647326.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 clarity.js Show response
www.clarity.ms/eus2-c/s/0.6.40/ 54 KB
23 KB 102ms
102ms Script
application/javascript 2620:1ec:27::cafe:2133
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/eus2-c/s/0.6.40/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/5612726
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:27::cafe:2133 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: bbffae0d03e6d48b808856596e595ab718c08bbc4476e7323bfcff4a6f833260

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:15 GMT
content-encoding: br
etag: "1d8c7baa5622330"
last-modified: Wed, 01 Jun 2022 12:22:22 GMT
x-powered-by: ASP.NET
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
x-azure-ref: 06w4qYwAAAAAqhpCBI3FSRJ0Hc0q4o1tFUFJBRURHRTEzMTIANmNmYmVlZTAtNTAyNy00ODRiLTg5NjctNGEyOWFmNzdmMWUx
accept-ranges: bytes
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

POST
H2 204 collect Show response
i.clarity.ms/ 0
179 B 348ms
100ms XHR
text/plain 52.167.85.21
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/eus2-c/s/0.6.40/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.167.85.21 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-origin: https://action.unrefugees.org
date: Tue, 20 Sep 2022 19:05:15 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

POST
H2 204 collect Show response
i.clarity.ms/ 0
25 B 139ms
137ms XHR
text/plain 52.167.85.21
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/eus2-c/s/0.6.40/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.167.85.21 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-origin: https://action.unrefugees.org
date: Tue, 20 Sep 2022 19:05:15 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

GET
H3 200 payframe Show response
pay.google.com/gp/p/ui/ Frame C1A3 18 KB
7 KB 255ms
210ms Document
text/html 2a00:1450:400c:c04::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Faction.unrefugees.org&mid=

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/js/pay.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c04::5c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6a9099edc840cf59fd747ce890e7328107ec98292e9427fbbd9aa7d3b66e6d97

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-VgizII4IxtJPGoH8Bos28w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=3600
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-VgizII4IxtJPGoH8Bos28w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-site
date: Tue, 20 Sep 2022 19:05:19 GMT
expires: Tue, 20 Sep 2022 19:05:19 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 0

GET
H2 204 0
bat.bing.com/action/ 0
176 B 39ms
39ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5612726&tm=gtm002&Ver=2&mid=a4f8ea46-f7f9-41c0-89b0-d818bf5ff05c&sid=2b4a4cc0391711ed9ece47a42ea76600&vid=2b4a79a0391711edb06edfed2f84baba&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&kw=petition&p=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&r=&lt=9360&evt=pageLoad&sv=1&rn=162355

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 52DD9AF90BEF4E49A2A8D5C6464945B1 Ref B: FRA31EDGE0115 Ref C: 2022-09-20T19:05:19Z
date: Tue, 20 Sep 2022 19:05:19 GMT
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

beacon
r.turn.com/r/
Redirect Chain

https://20668909p.rfihub.com/ca.gif?rb=9587&ca=20668909&ra=74281357
https://r.turn.com/r/beacon?b2=2ktLc5k8nNM07yj6GA-Hrn8gtUS_nFcwtDx5qaA26AoeU_Oup029YVIprkeGvqSpoIUReErvK66MTKJfORKOtg&cid=

43 B
398 B

137ms
28ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/beacon?b2=2ktLc5k8nNM07yj6GA-Hrn8gtUS_nFcwtDx5qaA26AoeU_Oup029YVIprkeGvqSpoIUReErvK66MTKJfORKOtg&cid=
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

Location: https://r.turn.com/r/beacon?b2=2ktLc5k8nNM07yj6GA-Hrn8gtUS_nFcwtDx5qaA26AoeU_Oup029YVIprkeGvqSpoIUReErvK66MTKJfORKOtg&cid=
Date: Tue, 20 Sep 2022 19:05:19 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 115ms
14ms Script
application/x-javascript 2600:9000:206e:a000:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:a000:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 18:15:31 GMT
content-encoding: br
last-modified: Tue, 20 Sep 2022 18:15:21 GMT
server: Jetty(9.3.29.v20201019)
age: 2988
vary: Accept-Encoding
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
via: 1.1 f39b904b3d29bdb5e473689299f6dedc.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
x-amz-cf-pop: VIE50-C1
content-type: application/x-javascript
x-amz-cf-id: smGjUNBVPH-O5XUacivRAwSaidSyoWJJq7BrArGaDDqpc9KSr7CKCw==
expires: Tue, 20 Sep 2022 19:15:31 GMT

GET
H/1.1 200
OK event Show response
ad.ipredictive.com/d/track/ Frame 7473 0
327 B 429ms
104ms Document
text/plain 23.22.216.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.ipredictive.com/d/track/event?upid=101374&cache_buster=1663700715&url=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU
Requested by: Host: js.ipredictive.com
URL: https://js.ipredictive.com/adelphic_universal_pixel.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.22.216.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-22-216-223.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 20 Sep 2022 19:05:19 GMT
X-CI-RTID: c2a3d1cb-0475-46e4-b0e0-91a3ae203fd9

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 5A42 43 KB
23 KB 30ms
29ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfMg_EaAAAAAMhDNLMlgqDChzmtYHlx1yU2y7GI&co=aHR0cHM6Ly9hY3Rpb24udW5yZWZ1Z2Vlcy5vcmc6NDQz&hl=en&v=zmiYzsHi8INTJBWt2QZC9aM5&theme=light&size=normal&cb=rrw7f7dnku7s

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a8ae08f3e515271600b4e888481296d92ff9f51c4a038881e5c3e94ac6ef92f4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oAp6stxFaL5d_zzKn9avwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 23084
content-security-policy: script-src 'report-sample' 'nonce-oAp6stxFaL5d_zzKn9avwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 20 Sep 2022 19:05:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/ Frame 5A42 52 KB
24 KB 28ms
9ms Stylesheet
text/css 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfMg_EaAAAAAMhDNLMlgqDChzmtYHlx1yU2y7GI&co=aHR0cHM6Ly9hY3Rpb24udW5yZWZ1Z2Vlcy5vcmc6NDQz&hl=en&v=zmiYzsHi8INTJBWt2QZC9aM5&theme=light&size=normal&cb=rrw7f7dnku7s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 15:24:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13265
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24251
x-xss-protection: 0
last-modified: Wed, 14 Sep 2022 00:24:01 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Sep 2023 15:24:14 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/ Frame 5A42 388 KB
154 KB 32ms
13ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/recaptcha__en.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d94d48861ea4d1585e765d393147dafc3df44e3f33a2150b944bca4815cf9e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 16:13:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10295
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 157726
x-xss-protection: 0
last-modified: Wed, 14 Sep 2022 00:24:01 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Sep 2023 16:13:44 GMT

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 36ms
16ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-P9YZZV758Y&gtm=2oe9j0&_p=2009918982&cid=1350372577.1663700714&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_z=ccd.v9B&_s=2&sid=1663700714&sct=1&seg=0&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&dt=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&en=scroll&epn.percent_scrolled=90&_et=7
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P9YZZV758Y&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://action.unrefugees.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ca.html Show response
20826429p.rfihub.com/ Frame DE0F 3 KB
4 KB 171ms
20ms Document
text/html 193.0.160.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20826429p.rfihub.com/ca.html?ver=9&rb=9587&ca=20826429&_o=9587&_t=20826429&pe=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&pf=&ra=3636986014801098
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.129 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 176c932bf57ba3c52cd6663175a8fe3b9491593ff32d031d3ffabdc5ac7868f1

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 3087
Content-Type: text/html;charset=utf-8
Date: Tue, 20 Sep 2022 19:05:19 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
DATA 200
OK truncated
/ Frame 5A42 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 5A42 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 5A42 2 KB
2 KB 11ms
11ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Thu, 15 Sep 2022 19:40:09 GMT
x-content-type-options: nosniff
age: 429910
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Thu, 22 Sep 2022 19:40:09 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5A42 15 KB
16 KB 81ms
6ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 11:18:05 GMT
x-content-type-options: nosniff
age: 28034
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 20 Sep 2023 11:18:05 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 5A42 102 B
134 B 24ms
19ms Other
text/javascript 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=zmiYzsHi8INTJBWt2QZC9aM5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d75bacb8a9f1c159d75122ccb63902a6e0f763d8cc12d9914d4839111bacce7d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfMg_EaAAAAAMhDNLMlgqDChzmtYHlx1yU2y7GI&co=aHR0cHM6Ly9hY3Rpb24udW5yZWZ1Z2Vlcy5vcmc6NDQz&hl=en&v=zmiYzsHi8INTJBWt2QZC9aM5&theme=light&size=normal&cb=rrw7f7dnku7s
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Tue, 20 Sep 2022 19:05:19 GMT

POST
H3 404 cspreport
pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/ Frame C1A3 2 KB
2 KB 21ms
20ms Other
text/html 2a00:1450:400c:c04::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400c:c04::5c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101

Request headers

Referer: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Faction.unrefugees.org&mid=
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
referrer-policy: no-referrer
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1608
content-type: text/html; charset=UTF-8

GET
H3 200 m=_b,_tp,_r Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfri... Frame C1A3 153 KB
54 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfridH7xDcEcQsSXqOZo5zRfBOM9DYA/m=_b,_tp,_r

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Faction.unrefugees.org&mid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ddd18c4dbec8a4fe349255f4e5a35d9757cfa9c1e50daa337059d099118c8b1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 16:19:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 528350
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55113
x-xss-protection: 0
last-modified: Wed, 14 Sep 2022 05:25:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Thu, 14 Sep 2023 16:19:29 GMT

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame A09B 7 KB
1 KB 22ms
20ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=zmiYzsHi8INTJBWt2QZC9aM5&k=6LfMg_EaAAAAAMhDNLMlgqDChzmtYHlx1yU2y7GI

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

98f1335d51cff50897bc21a0fd2956cf7ba19f5e2464d17d9048637e02a311e4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lXoALadqDvRdPxmhWwK_ig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 1117
content-security-policy: script-src 'report-sample' 'nonce-lXoALadqDvRdPxmhWwK_ig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 20 Sep 2022 19:05:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

cm
a.rfihub.com/ Frame DE0F
Redirect Chain

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTE0MjMzNjcxOTkyMDEzNDAwOA==&forward=
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESELpk61ZRmM5Rtvf_7Ad_W5Q&google_cver=1

42 B
1013 B

1151ms
19ms

Image
image/gif

193.0.160.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESELpk61ZRmM5Rtvf_7Ad_W5Q&google_cver=1
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: HTTP/1.1
Server: 193.0.160.129 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 19:05:20 GMT
Cache-Control: no-cache
Server: Jetty(9.3.29.v20201019)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESELpk61ZRmM5Rtvf_7Ad_W5Q&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 311
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame DE0F
Redirect Chain

https://ib.adnxs.com/setuid?entity=18&code=5142336719920134008
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D5142336719920134008

43 B
1 KB

23ms
22ms

Image
image/gif

185.89.211.116
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D5142336719920134008

Requested by

Protocol

HTTP/1.1

Server

185.89.211.116 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 20 Sep 2022 19:05:19 GMT
X-Proxy-Origin: 81.95.5.37; 81.95.5.37; 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: dacbdc5a-1383-40e6-a79e-0392c3a8a24b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 20 Sep 2022 19:05:19 GMT
X-Proxy-Origin: 81.95.5.37; 81.95.5.37; 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 35d8e71a-d0dc-408f-8fcc-be90af6ff7de
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D5142336719920134008
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame DE0F 0
239 B 61ms
12ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=5142336719920134008&
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame DE0F
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5142336719920134008&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5142336719920134008&redir=

42 B
942 B

48ms
47ms

Image
image/gif

46.51.204.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5142336719920134008&redir=

Protocol

HTTP/1.1

Server

46.51.204.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-46-51-204-238.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v041-000af07c7.edge-irl1.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: iUF8gnnOR/w=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v041-032826d7e.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: SZ2nte7ATko=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5142336719920134008&redir=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1

200
OK

match
ps.eyeota.net/ Frame DE0F
Redirect Chain

https://p.rfihub.com/cm?pub=24472&in=1
https://ps.eyeota.net/match?uid=5142336719920134008&bid=omt9pi0

0
344 B

64ms
10ms

Image
text/plain

3.120.214.218
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=5142336719920134008&bid=omt9pi0
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: HTTP/1.1
Server: 3.120.214.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-120-214-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 19:05:19 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: https://ps.eyeota.net/match?uid=5142336719920134008&bid=omt9pi0
Date: Tue, 20 Sep 2022 19:05:19 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 cksync.php
contextual.media.net/ Frame DE0F 45 B
616 B 97ms
52ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=5142336719920134008

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
server: Apache
date: Tue, 20 Sep 2022 19:05:19 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Tue, 20 Sep 2022 19:05:19 GMT

GET
H2 200 serving
bs.serving-sys.com/ Frame DE0F 0
105 B 145ms
34ms Image
text/plain 18.159.84.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bs.serving-sys.com/serving?cn=um&dpid=12&rtu=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D17945%26userid%3D%5B%25tp_UserID%25%5D
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.159.84.131 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-84-131.eu-central-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
content-length: 0
p3p: CP="NOI DEVa OUR BUS UNI"

GET
H3

451

501709.gif
idsync.rlcdn.com/ Frame DE0F
Redirect Chain

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5142336719920134008&referrer=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm...
https://p.rfihub.com/cm?pub=39342&in=0&userid=02efb0c8-33e2-4b10-8d28-03f636b6d8e4%3A1663700719.6252806&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D02efb0c8-33e2-4b10-8d28-03f636b...
https://idsync.rlcdn.com/501709.gif?partner_uid=02efb0c8-33e2-4b10-8d28-03f636b6d8e4%3A1663700719.6252806

0
9 B

39ms
20ms

Image
text/plain

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/501709.gif?partner_uid=02efb0c8-33e2-4b10-8d28-03f636b6d8e4%3A1663700719.6252806
Protocol: H3
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

Location: https://idsync.rlcdn.com/501709.gif?partner_uid=02efb0c8-33e2-4b10-8d28-03f636b6d8e4%3A1663700719.6252806
Date: Tue, 20 Sep 2022 19:05:19 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 /
bpi.rtactivate.com/tag/ Frame DE0F 43 B
109 B 740ms
278ms Image
image/gif 54.84.86.17
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=11017&user_id=5142336719920134008
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.86.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-86-17.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:20 GMT
server: awselb/2.0
content-length: 43
content-type: image/gif

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DE0F
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336719920134008&forward=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336719920134008&forward=&C=1

43 B
879 B

167ms
137ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336719920134008&forward=&C=1
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

cf-ray: 74dcd4f99e959091-FRA
pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Pa5nK5Xer2GiqTuhLESTht5tdJQe9YJ8KU4GNOKFVbLBr2Ye4v%2FiOA7H50lVzCyUL8IejCXOfviWnkB9wcx%2BA%2BbKxNAIrmdlBbcZlVbDFJWzv8eO1gb2sOXueCSkNsowiJrY6MrS%2BNSwg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=97eOtikQBqxD2xKtsy%2FsrfyfvyvirTsljxa5n2PApYpNdXBDgBjY8A3A5RqobMJsZfr0iYeAORnKjXUpDBDSozKTqSGKHOGgNrLVfOwOc0TUK701usGujxtvTLGBaO5COxNXAwPiQ2cXjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=57&external_user_id=5142336719920134008&forward=&C=1
cache-control: no-cache
cf-ray: 74dcd4f93c069a41-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 451 360947.gif
idsync.rlcdn.com/ Frame DE0F 0
98 B 66ms
19ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/360947.gif?partner_uid=5142336719920134008
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 rocketfuel_sync
x.dlx.addthis.com/e/ Frame DE0F 43 B
191 B 601ms
231ms Image
image/gif 104.96.159.57
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://x.dlx.addthis.com/e/rocketfuel_sync?na_exid=5142336719920134008

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.96.159.57 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-96-159-57.deploy.static.akamaitechnologies.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:20 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 20 Sep 2022 19:05:20 GMT
content-length: 43
strict-transport-security: max-age=2628000
content-type: image/gif

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame DE0F
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336719920134008&img=1
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336719920134008&img=1&__user_check__=1&sync_id=2ba01a9a-3917-11ed-9181-143d56a10306

43 B
548 B

20ms
18ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336719920134008&img=1&__user_check__=1&sync_id=2ba01a9a-3917-11ed-9181-143d56a10306
Protocol: HTTP/1.1
Server: 185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 19:05:19 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 83
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Tue, 20 Sep 2022 19:05:19 GMT
Server: nginx
Location: /partner?adv_id=7180&uid=5142336719920134008&img=1&__user_check__=1&sync_id=2ba01a9a-3917-11ed-9181-143d56a10306
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 112
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
partners.tremorhub.com/ Frame DE0F 43 B
183 B 320ms
95ms Image
image/gif 2600:1f18:612b:4200:2656:ce7a:55d6:eee3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIRF=5142336719920134008&r=2Ck-h1HYtmiJ
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4200:2656:ce7a:55d6:eee3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame DE0F 43 B
377 B 80ms
11ms Image
image/gif 52.59.153.178
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=5142336719920134008
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.153.178 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-153-178.eu-central-1.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
expires: 0

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame DE0F 0
339 B 132ms
30ms Image
text/plain 34.249.119.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner_id=rfuel&partner_user_id=5142336719920134008
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.119.142 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-119-142.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
cache-control: private, no-cache, no-store
x-request-time: D=25 t=1663700719
x-served-by: beacon-n003-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

sync
x.bidswitch.net/ul_cb/ Frame DE0F
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=119&user_id=5142336719920134008&expires=30
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5142336719920134008&expires=30

43 B
495 B

10ms
10ms

Image
image/gif

3.120.20.226
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5142336719920134008&expires=30
Protocol: HTTP/1.1
Server: 3.120.20.226 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-120-20-226.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 19:05:19 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5142336719920134008&expires=30
Date: Tue, 20 Sep 2022 19:05:19 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 503 /
sync-tm.everesttech.net/upi/pid/Mlpt2JaG/ Frame DE0F 0
177 B 54ms
9ms Image
text/plain 151.101.194.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20826429p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1663700720.800402,VS0,VE0
x-cache: MISS
cache-control: no-cache
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
retry-after: 0
x-served-by: cache-hhn4050-HHN

GET
H3 200 m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.mv4... Frame C1A3 78 KB
28 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.mv4xZHJoyWM.L.B1.O/am=B4A/d=1/exm=_b,_r,_tp/excm=_b,_r,_tp,payframeview/ed=1/wt=2/rs=AMitfrgxRhgQ_eZjmCM8K5cGIvMLciznXQ/ee=cEt90b:ws9Tlc;QGR0gd:Mlhmy;uY49fb:COQbmf;yEQyxe:p8L0ob;iFQyKf:vfuNJf;nAFL3:NTMZac;oGtAuc:sOXFj;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;dIoSBb:SpsfSb;eBAeSb:zbML3c;EmZ2Bf:zr1jrb;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;Pjplud:EEDORb;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:VDovNc;sP4Vbe:VwDzFe;kMFpHd:OTA3Ae;SNUn3:ZwDk9d/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfridH7xDcEcQsSXqOZo5zRfBOM9DYA/m=_b,_tp,_r

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8e68591784cfded415de1a9f6a6c79183971b9458560dce6ece10c138952703

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 16:30:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 527671
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29016
x-xss-protection: 0
last-modified: Fri, 09 Sep 2022 23:26:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Thu, 14 Sep 2023 16:30:48 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/ Frame A09B 52 KB
24 KB 9ms
7ms Stylesheet
text/css 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=zmiYzsHi8INTJBWt2QZC9aM5&k=6LfMg_EaAAAAAMhDNLMlgqDChzmtYHlx1yU2y7GI

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 15:24:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13265
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24251
x-xss-protection: 0
last-modified: Wed, 14 Sep 2022 00:24:01 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Sep 2023 15:24:14 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/ Frame A09B 388 KB
154 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/zmiYzsHi8INTJBWt2QZC9aM5/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=zmiYzsHi8INTJBWt2QZC9aM5&k=6LfMg_EaAAAAAMhDNLMlgqDChzmtYHlx1yU2y7GI

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d94d48861ea4d1585e765d393147dafc3df44e3f33a2150b944bca4815cf9e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 16:13:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10295
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 157726
x-xss-protection: 0
last-modified: Wed, 14 Sep 2022 00:24:01 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Sep 2023 16:13:44 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame C1A3 49 KB
20 KB 14ms
8ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.mv4xZHJoyWM.L.B1.O/am=B4A/d=1/exm=_b,_r,_tp/excm=_b,_r,_tp,payframeview/ed=1/wt=2/rs=AMitfrgxRhgQ_eZjmCM8K5cGIvMLciznXQ/ee=cEt90b:ws9Tlc;QGR0gd:Mlhmy;uY49fb:COQbmf;yEQyxe:p8L0ob;iFQyKf:vfuNJf;nAFL3:NTMZac;oGtAuc:sOXFj;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;dIoSBb:SpsfSb;eBAeSb:zbML3c;EmZ2Bf:zr1jrb;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;Pjplud:EEDORb;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:VDovNc;sP4Vbe:VwDzFe;kMFpHd:OTA3Ae;SNUn3:ZwDk9d/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 199
date: Tue, 20 Sep 2022 19:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 20 Sep 2022 21:02:00 GMT

GET
H3 200 pay Show response
pay.google.com/gp/p/ui/ Frame C1A3 1 MB
353 KB 76ms
73ms XHR
text/html 2a00:1450:400c:c04::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/pay

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfridH7xDcEcQsSXqOZo5zRfBOM9DYA/m=_b,_tp,_r

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c04::5c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

24eb957e8f80ecb382ad3d5ebd84b140c7d5a1d8d57337aba28cc5bb03076a75

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-vj_tKzKcYfQQDS-HKQA3BQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge
server: ESF
cross-origin-opener-policy: unsafe-none
date: Tue, 20 Sep 2022 19:05:19 GMT
x-frame-options: DENY
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: private, max-age=3600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-vj_tKzKcYfQQDS-HKQA3BQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist
expires: Tue, 20 Sep 2022 19:05:19 GMT

GET
H3 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.mv4... Frame C1A3 18 KB
7 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.mv4xZHJoyWM.L.B1.O/am=B4A/d=1/exm=Das5Le,IZT63,PrPYRd,Ru0Pgb,ZyYHPb,_b,_r,_tp,hc6Ubd,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_r,_tp,payframeview/ed=1/wt=2/rs=AMitfrgxRhgQ_eZjmCM8K5cGIvMLciznXQ/ee=cEt90b:ws9Tlc;QGR0gd:Mlhmy;uY49fb:COQbmf;yEQyxe:p8L0ob;iFQyKf:vfuNJf;nAFL3:NTMZac;oGtAuc:sOXFj;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;dIoSBb:SpsfSb;eBAeSb:zbML3c;EmZ2Bf:zr1jrb;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;Pjplud:EEDORb;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:VDovNc;sP4Vbe:VwDzFe;kMFpHd:OTA3Ae;SNUn3:ZwDk9d/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfridH7xDcEcQsSXqOZo5zRfBOM9DYA/m=_b,_tp,_r

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47a88df5478f6afd3e15676a143f0b0b8e0e8c87f03b4c1a908cef98c1402201

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 16:30:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 527671
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7399
x-xss-protection: 0
last-modified: Fri, 09 Sep 2022 23:26:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Thu, 14 Sep 2023 16:30:48 GMT

GET
H3 200 m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.mv4... Frame C1A3 37 KB
14 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.mv4xZHJoyWM.L.B1.O/am=B4A/d=1/exm=Das5Le,FCpbqb,IZT63,PrPYRd,Ru0Pgb,WhJNk,Wt6vjf,ZyYHPb,_b,_r,_tp,hc6Ubd,hhhU8,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_r,_tp,payframeview/ed=1/wt=2/rs=AMitfrgxRhgQ_eZjmCM8K5cGIvMLciznXQ/ee=cEt90b:ws9Tlc;QGR0gd:Mlhmy;uY49fb:COQbmf;yEQyxe:p8L0ob;iFQyKf:vfuNJf;nAFL3:NTMZac;oGtAuc:sOXFj;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;dIoSBb:SpsfSb;eBAeSb:zbML3c;EmZ2Bf:zr1jrb;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;Pjplud:EEDORb;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:VDovNc;sP4Vbe:VwDzFe;kMFpHd:OTA3Ae;SNUn3:ZwDk9d/m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfridH7xDcEcQsSXqOZo5zRfBOM9DYA/m=_b,_tp,_r

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

59b29cf164ab12b5d1220067310ebc72a95a9190969e5e78caa80489bf00d95f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 16:30:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 527671
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13983
x-xss-protection: 0
last-modified: Fri, 09 Sep 2022 23:26:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Thu, 14 Sep 2023 16:30:48 GMT

POST
H3 200 log Show response
play.google.com/ Frame C1A3 131 B
155 B 57ms
21ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfridH7xDcEcQsSXqOZo5zRfBOM9DYA/m=_b,_tp,_r

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Tue, 20 Sep 2022 19:05:19 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 71ms
34ms Preflight
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 20 Sep 2022 19:05:19 GMT
expires: Tue, 20 Sep 2022 19:05:19 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame C1A3 131 B
155 B 20ms
20ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfridH7xDcEcQsSXqOZo5zRfBOM9DYA/m=_b,_tp,_r

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Tue, 20 Sep 2022 19:05:19 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 284ms
254ms Preflight
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 20 Sep 2022 19:05:19 GMT
expires: Tue, 20 Sep 2022 19:05:19 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame C1A3 131 B
155 B 18ms
18ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfridH7xDcEcQsSXqOZo5zRfBOM9DYA/m=_b,_tp,_r

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Tue, 20 Sep 2022 19:05:19 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 279ms
254ms Preflight
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 20 Sep 2022 19:05:19 GMT
expires: Tue, 20 Sep 2022 19:05:19 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H2 200 log Show response
play.google.com/ Frame C1A3 131 B
671 B 60ms
23ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.43xDc-Z3j1k.es5.O/am=B4A/d=1/excm=_b,_r,_tp,payframeview/ed=1/dg=0/wt=2/rs=AMitfridH7xDcEcQsSXqOZo5zRfBOM9DYA/m=_b,_tp,_r

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 20 Sep 2022 19:05:19 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Tue, 20 Sep 2022 19:05:19 GMT

GET
H2 200 nr-1216.min.js Show response
js-agent.newrelic.com/ 38 KB
14 KB 60ms
15ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1216.min.js
Requested by: Host: action.unrefugees.org
URL: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-amz-version-id: mHHzJIqOizHibcYt0xqAszRr0gQRiNYy
content-encoding: gzip
etag: "9f533d8cd24b2c5e3b4dc886ecbd43e8"
x-amz-request-id: PT1X3XEF2KF64GRE
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 14391
x-amz-id-2: rWr2JWGo0/hJJpCkOl46Jludz4/khIecVhbiRQQ0qpVwJVN5XkS3fA4iIlbnsr7DzvXsY648nRw=
x-served-by: cache-hhn4024-HHN
last-modified: Thu, 14 Apr 2022 16:45:57 GMT
server: AmazonS3
x-timer: S1663700720.723962,VS0,VE0
date: Tue, 20 Sep 2022 19:05:19 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 7225

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=9DFCF1E4792649AA9803FFCE1FD72801&RedC=c.clarity.ms&MXFR=10C51AD02869647C1A8408F52C696AB8
https://c.clarity.ms/c.gif?CtsSyncId=9DFCF1E4792649AA9803FFCE1FD72801&MUID=232E2DF4D99866F31C433FD1D834673E

42 B
369 B

31ms
30ms

Image
image/gif

20.234.93.27
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=9DFCF1E4792649AA9803FFCE1FD72801&MUID=232E2DF4D99866F31C433FD1D834673E
Protocol: H2
Server: 20.234.93.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:18 GMT
last-modified: Tue, 13 Sep 2022 19:54:52 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "8d3298b0aac7d81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 81B4D4E508AA487CAAB9749288FF02CC Ref B: FRA31EDGE0115 Ref C: 2022-09-20T19:05:19Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=9DFCF1E4792649AA9803FFCE1FD72801&MUID=232E2DF4D99866F31C433FD1D834673E
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 20ms
19ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=2009918982&t=event&ni=1&_s=1&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&ul=en-us&de=UTF-8&dt=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Ftitle42-petition-adv-email-2022%2F&el=25%25&_u=aCHACEABBAAAAG~&jid=34201106&gjid=1347012857&cid=1350372577.1663700714&tid=UA-3754388-9&_gid=1501666799.1663700714&_r=1&gtm=2wg9j0XT4L&z=2081096536

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://action.unrefugees.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 16ms
10ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=2009918982&t=event&ni=1&_s=1&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&ul=en-us&de=UTF-8&dt=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Ftitle42-petition-adv-email-2022%2F&el=50%25&_u=aCHACEABBAAAAG~&jid=&gjid=&cid=1350372577.1663700714&tid=UA-3754388-9&_gid=1501666799.1663700714&gtm=2wg9j0XT4L&z=523303774

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 12:40:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23098
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 16ms
11ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=2009918982&t=event&ni=1&_s=1&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&ul=en-us&de=UTF-8&dt=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Ftitle42-petition-adv-email-2022%2F&el=75%25&_u=aCHACEABBAAAAG~&jid=&gjid=&cid=1350372577.1663700714&tid=UA-3754388-9&_gid=1501666799.1663700714&gtm=2wg9j0XT4L&z=1916056816

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 12:40:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23098
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 15ms
11ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=2009918982&t=event&ni=1&_s=1&dl=https%3A%2F%2Faction.unrefugees.org%2Ftitle42-petition-adv-email-2022%2F%3Futm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU%26utm_medium%3Demail%26utm_cid%3D0031K00003CjI07QAF%26utm_source%3Du4u-update%26utm_campaign%3DUS_PS_EN_CORE_UPDATE___220920%26utm_content%3Dfullfile%26SF_onetime%3D7011K0000023NwSQAU%26SF_monthly%3D7011K0000023NwXQAU&ul=en-us&de=UTF-8&dt=Sign%20Now%3A%20Stand%20with%20families%20seeking%20asylum%20at%20the%20U.S.%20southern%20border%20%7C%20USA%20for%20UNHCR&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Ftitle42-petition-adv-email-2022%2F&el=100%25&_u=aCHACEABBAAAAG~&jid=&gjid=&cid=1350372577.1663700714&tid=UA-3754388-9&_gid=1501666799.1663700714&gtm=2wg9j0XT4L&z=1475537450

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 12:40:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23098
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 63ms
19ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-3754388-9&cid=1350372577.1663700714&jid=34201106&gjid=1347012857&_gid=1501666799.1663700714&_u=aCHACEABBAAAAG~&z=668781035

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 20 Sep 2022 19:05:19 GMT
content-type: text/plain
access-control-allow-origin: https://action.unrefugees.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 logger Show response
www.sandbox.paypal.com/xoplatform/logger/api/ 1000 B
1 KB 178ms
178ms XHR
application/json 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sandbox.paypal.com/xoplatform/logger/api/logger

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AXR8B71wtnEZHnlsTiphl1IRoxz4ZCoV5P4_FBhZeyaRBbGZXlD1_VE1c9hd2asTUQGyWBo7nyZo-_Mi&vault=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c48c397c1aaa2a44608462cb643dfc0f0d5036d528020d9e4747b53b8a140884

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept: application/json
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
content-type: application/json

Response headers

date: Tue, 20 Sep 2022 19:05:20 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS, MISS
paypal-debug-id: 45054f71270c5
server-timing: content-encoding;desc=br
content-encoding: br
x-served-by: cache-fra19139-FRA, cache-hhn4081-HHN
x-timer: S1663700720.019447,VS0,VE167
etag: W/W/"3e8-RHDUIIk68iAkwmvrVg9MeUzebmk"
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://action.unrefugees.org
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
accept-ranges: none
x-cache-hits: 0, 0

OPTIONS
H2 200 logger
www.sandbox.paypal.com/xoplatform/logger/api/ Frame 0
0 269ms
169ms Preflight 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sandbox.paypal.com/xoplatform/logger/api/logger

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://action.unrefugees.org
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

accept-ranges: none
access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://action.unrefugees.org
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: br
date: Tue, 20 Sep 2022 19:05:20 GMT
paypal-debug-id: dcc1f2485f855
server-timing: content-encoding;desc=br
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: accept-encoding
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-content-type-options: nosniff
x-served-by: cache-fra19138-FRA, cache-hhn4081-HHN
x-timer: S1663700720.845330,VS0,VE156

GET
H/1.1 200
OK cf888b8b66 Show response
bam.nr-data.net/1/ 49 B
620 B 325ms
287ms Script
text/javascript 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/cf888b8b66?a=357730915&v=1216.487a282&to=ZFNSZUsADUJYWxFRC10ZfWd6TjFUV1wASilFVXNeVxURXlVUAEpLfllURFUEM1BeXQ%3D%3D&rst=9951&ck=1&ref=https://action.unrefugees.org/title42-petition-adv-email-2022/&qt=1&ap=1214&be=4072&fe=9868&dc=9354&perf=%7B%22timing%22:%7B%22of%22:1663700709804,%22n%22:0,%22f%22:2074,%22dn%22:2074,%22dne%22:2074,%22c%22:2074,%22s%22:2253,%22ce%22:2455,%22rq%22:2458,%22rp%22:4042,%22rpe%22:4043,%22dl%22:4046,%22di%22:9353,%22ds%22:9353,%22de%22:9360,%22dc%22:9868,%22l%22:9868,%22le%22:9871%7D,%22navigation%22:%7B%7D%7D&fp=4696&fcp=4696&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1216.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 20 Sep 2022 19:05:20 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
access-control-allow-credentials: true
CF-Ray: 74dcd4fabf87bb4d-FRA

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 49ms
49ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3754388-9&cid=1350372577.1663700714&jid=34201106&_u=aCHACEABBAAAAG~&z=195495672

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 46ms
46ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3754388-9&cid=1350372577.1663700714&jid=34201106&_u=aCHACEABBAAAAG~&z=195495672

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Sep 2022 19:05:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect Show response
i.clarity.ms/ 0
48 B 98ms
97ms XHR
text/plain 52.167.85.21
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/eus2-c/s/0.6.40/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.167.85.21 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://action.unrefugees.org/title42-petition-adv-email-2022/?utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU&utm_medium=email&utm_cid=0031K00003CjI07QAF&utm_source=u4u-update&utm_campaign=US_PS_EN_CORE_UPDATE___220920&utm_content=fullfile&SF_onetime=7011K0000023NwSQAU&SF_monthly=7011K0000023NwXQAU
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-origin: https://action.unrefugees.org
date: Tue, 20 Sep 2022 19:05:20 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

Verdicts & Comments Add Verdict or Comment

112 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

61 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.com/	1970-01-20 10:31:51	Name: NID Value: 511=dcPUq2v4oXdXo_qr_Pxxzi_A-T4X-8JxvDderObvzx93lJ3n0sh1YO7e4KbeFZlwpp0DYjZ7kGZj7tgyxLT1JQQJmVdaVGrhvmU9wgkOmOTb_fc1YFdqkzpXCMMKzhiYtv3yYCOQMbJRgvs2jB6kZv_qQXrEewMHvk57CUER3FA
.unrefugees.org/	1970-01-20 08:17:56	Name: _gcl_au Value: 1.1.620289379.1663700714
.unrefugees.org/	1970-01-20 15:44:20	Name: _ga_P9YZZV758Y Value: GS1.1.1663700714.1.0.1663700714.60.0.0
www.tfaforms.com/	1970-01-20 06:18:25	Name: AWSALBTGCORS Value: iuiRaJA3TE5dAC1n4TnhSAJOq/RJzrOYuuBK1Hc9LMNWP3UklH5xs4od8as/CtWzdl9l8kaR3IywmTgsMnM5JQVvQc0D4eOMoN9l3lnJcGOGENP/iKpolNMN1U8xrqHpUxdCflQ6mhWqu2uM6DT8rW7xjdkOTDHqC6x6mlP7Kp3m
www.tfaforms.com/	1970-01-20 06:18:25	Name: AWSALBCORS Value: lu3bZBirXBGKSKI+3U+F4P00XYuU/iLOADSxxO86J45ZU6DVV1VyBsEVGOLhSTg/s+4eVd6bRl+xLNlEi8iXmzscMlEhgM+mG5DjC8wHdbwxQSWRGENJRJ1WVKu5
.unrefugees.org/	1970-01-20 08:17:56	Name: _fbp Value: fb.1.1663700714374.1711627554
.action.unrefugees.org/	1970-01-20 15:44:20	Name: _ga Value: GA1.3.1350372577.1663700714
.action.unrefugees.org/	1970-01-20 06:09:47	Name: _gid Value: GA1.3.1501666799.1663700714
.action.unrefugees.org/	1970-01-20 06:08:20	Name: _dc_gtm_UA-3754388-9UA-3754388-9 Value: 1
.action.unrefugees.org/	1970-01-20 06:08:20	Name: _dc_gtm_UA-1473340-18 Value: 1
.action.unrefugees.org/	1970-01-20 06:08:20	Name: _dc_gtm_UA-3754388-9 Value: 1
.mrtnsvr.com/	1970-01-20 14:55:23	Name: userId Value: t1J1Qsfap
.bing.com/	1970-01-20 15:29:56	Name: MUID Value: 232E2DF4D99866F31C433FD1D834673E
action.unrefugees.org/	1970-01-20 15:32:49	Name: qcSxc Value: 1663700714430
.quantserve.com/	1970-01-20 15:38:35	Name: mc Value: 632a0eea-7025d-388ef-41304
.unrefugees.org/	1970-01-20 15:32:49	Name: __qca Value: P0-1282475969-1663700714421
.tapad.com/	1970-01-20 07:34:44	Name: TapAd_TS Value: 1663700714475
.tapad.com/	1970-01-20 07:34:44	Name: TapAd_DID Value: 299cf3c8-1e68-434d-8730-7ae9e13a7ba9
.tapad.com/	1970-01-20 07:34:44	Name: TapAd_3WAY_SYNCS Value:
action.unrefugees.org/	1970-01-20 06:18:25	Name: AWSALB Value: WsnNmBdRdHv5xJRlcDd07OixOq3r5LV0xjzLuecqrclbgNKBSGSYJKL+W8L7W9jMar02DVwnLSEoqbf25dmzzp/wbXUl1pvmW5alwW5hTa28QWfRV6WeTk0WsK7I
action.unrefugees.org/	1970-01-20 06:18:25	Name: AWSALBCORS Value: WsnNmBdRdHv5xJRlcDd07OixOq3r5LV0xjzLuecqrclbgNKBSGSYJKL+W8L7W9jMar02DVwnLSEoqbf25dmzzp/wbXUl1pvmW5alwW5hTa28QWfRV6WeTk0WsK7I
action.unrefugees.org/	1970-01-20 15:44:20	Name: _tq_id.TV-63728109-1.8fd4 Value: d8a69bdffbc38b22.1663700715.0.1663700715..
.yahoo.com/	1970-01-20 14:54:18	Name: A3 Value: d=AQABBOoOKmMCENUnFBRns3U7DDBl05bEwrMFEgEBAQFgK2MzYwAAAAAA_eMAAA&S=AQAAAo4MHQRR0kPlsgSxc1bdnMo
.doubleclick.net/	1970-01-20 15:29:56	Name: IDE Value: AHWqTUlTYyswPwv5QEmdQXXwORqdXs-iKyG31DwbfoHCOpcWTraYmjdIL5wzCKyqIyA
www.clarity.ms/	1970-01-20 14:53:56	Name: CLID Value: ec567da729fe42f9bffa1242e10ee8d4.20220920.20230920
.unrefugees.org/	1970-01-20 14:53:56	Name: _clck Value: m93kjl\|1\|f51\|0
.unrefugees.org/	1970-01-20 06:09:47	Name: _clsk Value: sywsvx\|1663700715803\|1\|1\|i.clarity.ms/collect
.unrefugees.org/	1970-01-20 06:09:47	Name: _uetsid Value: 2b4a4cc0391711ed9ece47a42ea76600
.unrefugees.org/	1970-01-20 15:29:56	Name: _uetvid Value: 2b4a79a0391711edb06edfed2f84baba
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0MTI2NjM3tLQ0MjA0NjEwsBDiM9T1ynZ0jrDISgxKSvYAAG5RFyglAAAA
.rfihub.com/	1970-01-20 15:29:56	Name: rud Value: H4sIAAAAAAAA_-MSNjU0MTI2NjM3tLQ0MjA0NjEwsBDiM9T1ynZ0jrDISgxKSvYAAG5RFyglAAAA
.turn.com/	1970-01-20 10:27:32	Name: uid Value: 3757283541020363977
.adnxs.com/	1970-01-20 08:17:56	Name: uuid2 Value: 4598844878796910434
.casalemedia.com/	1970-01-20 14:53:56	Name: CMID Value: YyoO71B-eKj8Jra8E5koDgAA
.casalemedia.com/	1970-01-20 08:17:56	Name: CMPS Value: 5164
.casalemedia.com/	1970-01-20 08:17:56	Name: CMPRO Value: 5164
.adnxs.com/	1970-01-20 08:17:56	Name: anj Value: dTM7k!M4/YErk#WF']wIg2E>@uSzA*!]tbPl1MNu::wpAk`W=ifSt1mlxJOyfQC3Xe8)2Xn?QJK4^J$o!_6-zQEVk`!)rYxg8dQF
.media.net/	1970-01-20 14:53:56	Name: visitor-id Value: 3067023198173322000V10
.media.net/	1970-01-20 14:52:30	Name: data-rk Value: 5142336719920134008~~3
.ipredictive.com/	1970-01-20 14:53:56	Name: cu Value: 38f810be-ead5-4dda-8b77-06bb970483d9\|1663700719568
.eyeota.net/	1970-01-20 06:08:21	Name: SERVERID Value: 18829~DM
.unrefugees.org/	1970-01-20 15:44:20	Name: _ga Value: GA1.2.1350372577.1663700714
.unrefugees.org/	1970-01-20 06:09:47	Name: _gid Value: GA1.2.1501666799.1663700714
.unrefugees.org/	1970-01-20 06:08:20	Name: _gat_UA-3754388-9 Value: 1
.rezync.com/	1970-01-20 10:27:32	Name: zync-uuid Value: 02efb0c8-33e2-4b10-8d28-03f636b6d8e4:1663700719.6252806
live.rezync.com/	1970-01-20 10:27:32	Name: sd-session-id Value: .eJwNzNEKgzAMQNF_ybMdaVJj7M_ItBHKZjesvkz89_XxwuFeMH1t357FygHx2E_rYHnnVhXiBTX_NntBhN4HYpbBjyOh54CocHdQrdb8KVNOzSDZOuOijtnIhdmj00TqkFdhmSWphehFeEBso4dQT4oC9x-mGyVV.YyoO7w.oHIFLAj74S-N_KWRB6ulrCaDmBg
.spotxchange.com/	1970-01-20 06:48:39	Name: audience Value: 2ba01a60-3917-11ed-9181-143d56a10306
.casalemedia.com/	1970-01-20 08:17:56	Name: CMTS Value: 1189
.krxd.net/	1970-01-20 10:27:32	Name: _kuid_ Value: PFz8kFqV
.c.bing.com/	1970-01-20 15:29:56	Name: SRM_B Value: 232E2DF4D99866F31C433FD1D834673E
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 15:29:56	Name: MUID Value: 232E2DF4D99866F31C433FD1D834673E
.c.clarity.ms/	1970-01-20 06:08:21	Name: ANONCHK Value: 0
.bidswitch.net/	1970-01-20 14:53:56	Name: tuuid Value: a5aa7d6d-23d3-42d7-a858-c459a77dadcc
.bidswitch.net/	1970-01-20 14:53:56	Name: c Value: 1663700719
.bidswitch.net/	1970-01-20 14:53:56	Name: tuuid_lu Value: 1663700719
.demdex.net/	1970-01-20 10:27:32	Name: demdex Value: 55074072462502954853840283762092267733
.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: 6a3dc05ffef0abdd
.dpm.demdex.net/	1970-01-20 10:27:32	Name: dpm Value: 55074072462502954853840283762092267733
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAA_-OSMXR2dA129SnINjOMCsr1NQ0qKUuLN3dMiQ83DQQA_5ZHVx4AAAA
.rfihub.com/	1970-01-20 15:29:56	Name: eud Value: H4sIAAAAAAAA_-OSMXR2dA129SnINjOMCsr1NQ0qKUuLN3dMiQ83DQziNTQzMzY3MDA3MjA3NJrFCOcbWpqYmaxC459C479C4_9C409iQuXPQuMvQuOvQuNvQuPvQlfPgsq_hcw3NTPYxIqmnxvNvWj8RcKo_EdofABed1GlTQEAAA

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://idsync.rlcdn.com/360947.gif?partner_uid=5142336719920134008 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://idsync.rlcdn.com/501709.gif?partner_uid=02efb0c8-33e2-4b10-8d28-03f636b6d8e4%3A1663700719.6252806 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D Message: Failed to load resource: the server responded with a status of 503 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20668909p.rfihub.com
20826429p.rfihub.com
4647326.fls.doubleclick.net
a.rfihub.com
aa.agkn.com
action.unrefugees.org
ad.doubleclick.net
ad.ipredictive.com
adservice.google.com
adservice.google.de
bam.nr-data.net
bat.bing.com
beacon.krxd.net
bpi.rtactivate.com
bs.serving-sys.com
c.bing.com
c.clarity.ms
c1.rfihub.net
cdn.plyr.io
cdn.unrefugees.org
click.e.unrefugees.org
cm.g.doubleclick.net
code.jquery.com
collector-3219.tvsquared.com
connect.facebook.net
contextual.media.net
dpm.demdex.net
dsum-sec.casalemedia.com
event.mrtnsvr.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.clarity.ms
ib.adnxs.com
idsync.rlcdn.com
js-agent.newrelic.com
js.ipredictive.com
live.rezync.com
lyibja.unrefugees.org
p.rfihub.com
p.typekit.net
partners.tremorhub.com
pay.google.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
play.google.com
ps.eyeota.net
pxl.qccerttest.com
r.turn.com
region1.analytics.google.com
rules.quantcount.com
s.yimg.com
secure.quantserve.com
sp.analytics.yahoo.com
static-na.payments-amazon.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.search.spotxchange.com
use.typekit.net
www.clarity.ms
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.paypal.com
www.sandbox.paypal.com
www.tfaforms.com
www.tp88trk.com
x.bidswitch.net
x.dlx.addthis.com
104.18.18.126
104.96.159.57
13.111.228.216
142.250.184.194
142.250.185.198
142.250.186.134
142.250.186.34
143.204.215.11
151.101.194.49
151.101.65.21
151.101.66.137
162.247.241.14
18.159.84.131
185.89.211.116
185.94.180.125
193.0.160.129
2.18.235.93
20.234.93.27
2001:4860:4802:34::36
2001:4de0:ac18::1:a:2b
2001:678:cb4:bbbb::11
212.82.100.181
23.22.216.223
2600:1f18:612b:4200:2656:ce7a:55d6:eee3
2600:9000:2057:2e00:6:44e3:f8c0:93a1
2600:9000:206e:a000:1:76cf:fe80:93a1
2600:9000:214f:3200:11:615:7240:93a1
2606:4700:21::681b:c258
2620:116:800d:21:de2e:c7b3:55c0:d5a0
2620:1ec:27::cafe:2133
2620:1ec:c11::200
2a00:1288:f03d:1fa::2000
2a00:1450:4001:806::2003
2a00:1450:4001:809::2002
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2003
2a00:1450:4001:810::2004
2a00:1450:4001:812::200a
2a00:1450:4001:813::200e
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2008
2a00:1450:4001:830::2002
2a00:1450:4001:831::2003
2a00:1450:400c:c04::5c
2a00:1450:400c:c0c::9b
2a02:26f0:11a::6867:4841
2a02:26f0:11a::6867:4848
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f107:83:face:b00c:0:25de
3.120.20.226
3.120.214.218
3.132.200.162
34.249.119.142
35.190.72.228
35.227.237.181
35.227.248.159
35.244.174.68
46.51.204.238
52.167.85.21
52.22.17.73
52.25.243.35
52.59.153.178
54.200.66.202
54.84.86.17
65.9.66.107
65.9.66.114
65.9.66.64
69.173.144.138
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0b98f9f666599d18f83e72683b9bf54591c01af7dbfffceda491f2dc59195b51
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14792c9a2a7e42d3e4f3a80f80ac3fb8a89db5959ce714ba5b3e525acd2da20e
176c932bf57ba3c52cd6663175a8fe3b9491593ff32d031d3ffabdc5ac7868f1
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
24eb957e8f80ecb382ad3d5ebd84b140c7d5a1d8d57337aba28cc5bb03076a75
2a72806e7ecf829960274016cfa7c3b84dd3f89fbba960f8e0e2b2fddfa743df
2be4c1816230ce629f009339ad2fd712c2b6962f7cff1c9ddd0020a54ee649ea
30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7
34686cba28b7d374710a0b8204ae2cbce77ced594bcac71bef4f5260a8d99745
35e56359a3010d1973d3505a00c79e1cef65219cbf6f74d0516ba255bad73be1
3646ba424a243eced19cd620a49975600163535c9196bf2e5d89a035ea255adf
38c9c1413e17c7a5ee87095bdb4cad0da069451ee937cb801c8f37f2c734644f
3d94d48861ea4d1585e765d393147dafc3df44e3f33a2150b944bca4815cf9e4
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3e58ba4183513ddd7218be6232686b424a74a54a41bfbfe96358029ed758260c
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
465ecd3c27cf42a3309af6bda6e2b8c4b9cb7a78788908904e0d6761a2c3102a
46ecb79454ead6331e674b2eb63126f4dc947268e662863f42a3e6fdc494f115
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
47a88df5478f6afd3e15676a143f0b0b8e0e8c87f03b4c1a908cef98c1402201
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
546b29c0d58453484fe0efe4e8715a16f88594ce3ec85ac598e2d1a065347df4
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5618595d9e8a507cd2220456357bca005b987f2d0f1379a476ddf064cb9c0f10
59b29cf164ab12b5d1220067310ebc72a95a9190969e5e78caa80489bf00d95f
5ac302a7b4a4114b8b21685bf9bbd8871e41beb806a89a4f18f78549a1e00ef5
62c0466b6e78094d8bb9b9fb50f13f3eb39e3be88dce7663ecfbcabde18b64bc
64869176015533649b3a7ddb21322dfc9c47a3e55d80218655bd30b4cc22a684
6a9099edc840cf59fd747ce890e7328107ec98292e9427fbbd9aa7d3b66e6d97
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bc64e1dcd1d00c6730b2d5cd95c6f6ff679d1659003d0afa0a55611b6c25f89
6bfbae61daf6218548d35bd824d5299e6f0517f156050c302ddd83fa0e8abdc8
6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708
71a4954bfc82b7512ffe6f4c8a53e763a37157f399c94b13b2fe4bd423b5e86e
73ef385046533349dbdb6264bfdb814819b44a3a7ddeedf7611db7d55f567c7c
7bcbe327243628310e84027b85bca98a20d208f66f64685d979c6ccfa587d2d2
7c707b4d486575fcdf35497e30073fd70f0a9ea072e4ca1ca724da7fbab22a9b
7cb56da908e94235a698c35dac8162e57993bfceefba669afddc29bd866b97f8
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
81f701abbdb3dcd7318338357add41af96a3b776549dc928c4703cf1cf9f2ffe
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
844bfb2ff3311ad9b5611b51d8c72e0c483a8ceafe7c625a5c321637f9277399
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
853bcc9a357f2f04e005b3bfcc614e10788ba9d5d0089482b9da1b84f6206ffa
8608c7129a24079dd332403d0aef583dcefdf0bfc02914d626a6559a3ac049ad
9337f499c9b0cc63404026b5448c6fd449df6ed57abf148722751a3a4b992c54
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
98f1335d51cff50897bc21a0fd2956cf7ba19f5e2464d17d9048637e02a311e4
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
99d51d558fc1c0945ae19933dd77debe55eb982b7838972110cfdec4b633ea63
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4
a8ae08f3e515271600b4e888481296d92ff9f51c4a038881e5c3e94ac6ef92f4
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2d4cd9636fffaedb0624257ca78b11f3abee42db7072400e8f4042e7cfd711d
bbffae0d03e6d48b808856596e595ab718c08bbc4476e7323bfcff4a6f833260
bd10041b6aabbb41f44207a8cc8c60b4b1b57be240fae710053455fb2d6fc46f
c48c397c1aaa2a44608462cb643dfc0f0d5036d528020d9e4747b53b8a140884
caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10
cc41b89e82e346d38089fb2b430ff6c1864aa655f0c5003abc35d45d8b7bb1f0
cdeefb36cfc07c7d117078771fbc3eeaa918025a369ab1c92de84b35d03c9f88
d08c52cc003c28f266bcdf1924c340b183c1f32fb96da57550f6973f5fbe50a7
d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101
d75bacb8a9f1c159d75122ccb63902a6e0f763d8cc12d9914d4839111bacce7d
d8e68591784cfded415de1a9f6a6c79183971b9458560dce6ece10c138952703
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
ddd18c4dbec8a4fe349255f4e5a35d9757cfa9c1e50daa337059d099118c8b1b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e2745418333b88f0f9fdf29ca587b55aff361a219a1e1196adacffcd4c47fe69
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e9027cbc9f2efbff37e09740f41c16a1ffd89eae8f1555f6a5955d3198d9c31d
ec9ce281ea2b68a78bb11994bbda11df71edf8fc8a15ba80c945bf0f4f708848
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660

action.unrefugees.org Open in urlscan Pro 54.200.66.202 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

133 Requests

89 %HTTPS

43 %IPv6

51 Domains

74 Subdomains

64 IPs

8 Countries

2795 kBTransfer

6995 kBSize

61 Cookies

7 Outgoing links

Page URL History

Redirected requests

133 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

action.unrefugees.org Open in urlscan Pro
54.200.66.202 Public Scan

Screenshot
Live screenshot

Full Image

133
Requests

89 %
HTTPS

43 %
IPv6

51
Domains

74
Subdomains

64
IPs

8
Countries

2795 kB
Transfer

6995 kB
Size

61
Cookies

133 HTTP transactions
2 data transactions