equi5.subsidyaid.com Open in urlscan Pro
34.123.196.68 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ak.peethach.com/4/6960282/0.3289205788517042
Effective URL:
https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=789813...
Submission: On February 06 via api (February 6th 2024, 11:45:54 pm UTC) from US — Scanned from US

Summary HTTP 52 Redirects Behaviour Indicators

Summary

This website contacted 18 IPs in 4 countries across 17 domains to perform 52 HTTP transactions. The main IP is 34.123.196.68, located in Council Bluffs, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is equi5.subsidyaid.com.
TLS certificate: Issued by R3 on January 27th 2024. Valid for: 3 months.

This is the only time equi5.subsidyaid.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	23.12.146.138 23.12.146.138	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 18	104.21.83.214 104.21.83.214	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
1	37.48.68.71 37.48.68.71	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1 2	34.232.110.131 34.232.110.131	14618 (AMAZON-AES) (AMAZON-AES)
14	34.123.196.68 34.123.196.68	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2607:f8b0:400... 2607:f8b0:4004:c09::5f	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2607:f8b0:400... 2607:f8b0:4004:c19::61	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c06::5e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20ed:c800:9:5bab:8100:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.237.62.212 104.237.62.212	18450 (WEBNX) (WEBNX)
1	2600:1f18:16e... 2600:1f18:16e:df02::64	14618 (AMAZON-AES) (AMAZON-AES)
1	104.154.135.87 104.154.135.87	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f10... 2a03:2880:f103:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	54.197.77.77 54.197.77.77	14618 (AMAZON-AES) (AMAZON-AES)
1	34.120.195.249 34.120.195.249	() ()
52	18

1 23.12.146.138 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-12-146-138.deploy.static.akamaitechnologies.com

ak.peethach.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 104.21.83.214 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

totalnicenewz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.48.68.71 (Amsterdam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

datatechone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.232.110.131 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-232-110-131.compute-1.amazonaws.com

track.additionalbenefits.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.subsidyaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 34.123.196.68 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 68.196.123.34.bc.googleusercontent.com

equi5.subsidyaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::5f (Ashburn, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:c0e:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c19::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c06::5e (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20ed:c800:9:5bab:8100:93a1 (United States)

ASN16509 (AMAZON-02, US)

js.callcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.237.62.212 (El Segundo, United States)

ASN18450 (WEBNX, US)
PTR: api.ipify.org

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:16e:df02::64 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

lander-main-microservice.netlify.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.154.135.87 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 87.135.154.104.bc.googleusercontent.com

funnel.improveourcredit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f103:83:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.197.77.77 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-197-77-77.compute-1.amazonaws.com

display.ringba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.195.249 (None, )

ASN- ()

o4506236711272448.ingest.sentry.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	totalnicenewz.com 1 redirects totalnicenewz.com	78 KB
15	subsidyaid.com equi5.subsidyaid.com track.subsidyaid.com	1 MB
4	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 11663 Failed	2 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	69 KB
1	sentry.io o4506236711272448.ingest.sentry.io	590 B
1	ringba.com display.ringba.com — Cisco Umbrella Rank: 84171	789 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	185 B
1	improveourcredit.com funnel.improveourcredit.com — Cisco Umbrella Rank: 343387	2 KB
1	netlify.app lander-main-microservice.netlify.app — Cisco Umbrella Rank: 307967	993 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2768	220 B
1	callcdn.com js.callcdn.com — Cisco Umbrella Rank: 204208	3 KB
1	gstatic.com fonts.gstatic.com	62 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	45 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 28	847 B
1	additionalbenefits.org 1 redirects track.additionalbenefits.org	736 B
1	datatechone.com datatechone.com — Cisco Umbrella Rank: 49226	470 B
1	peethach.com ak.peethach.com — Cisco Umbrella Rank: 259600	2 KB
52	17

	Domain	Requested by
18	totalnicenewz.com	1 redirects ak.peethach.com totalnicenewz.com
14	equi5.subsidyaid.com	equi5.subsidyaid.com
4	my.rtmark.net	ak.peethach.com totalnicenewz.com
2	connect.facebook.net	equi5.subsidyaid.com connect.facebook.net
1	o4506236711272448.ingest.sentry.io	equi5.subsidyaid.com
1	display.ringba.com	equi5.subsidyaid.com
1	track.subsidyaid.com	lander-main-microservice.netlify.app
1	www.facebook.com	equi5.subsidyaid.com
1	funnel.improveourcredit.com	equi5.subsidyaid.com
1	lander-main-microservice.netlify.app	equi5.subsidyaid.com
1	api.ipify.org	equi5.subsidyaid.com
1	js.callcdn.com	equi5.subsidyaid.com
1	fonts.gstatic.com	fonts.googleapis.com
1	www.googletagmanager.com	equi5.subsidyaid.com
1	fonts.googleapis.com	equi5.subsidyaid.com
1	track.additionalbenefits.org	1 redirects
1	datatechone.com	totalnicenewz.com
1	ak.peethach.com
52	18

This site contains no links.

Subject Issuer	Validity	Valid
totalnicenewz.com GTS CA 1P5	`2024-01-19` - `2024-04-18`	3 months	crt.sh
rtmark.net R3	`2023-12-23` - `2024-03-22`	3 months	crt.sh
datatechone.com Sectigo RSA Domain Validation Secure Server CA	`2023-12-10` - `2024-12-23`	a year	crt.sh
equi5.subsidyaid.com R3	`2024-01-27` - `2024-04-26`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-16` - `2024-02-14`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.callcdn.com Amazon RSA 2048 M02	`2024-01-30` - `2025-02-26`	a year	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh
*.netlify.app DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-15` - `2025-02-14`	a year	crt.sh
funnel.improveourcredit.com R3	`2024-01-11` - `2024-04-10`	3 months	crt.sh
track.subsidyaid.com R3	`2024-01-16` - `2024-04-15`	3 months	crt.sh
*.ringba.com Amazon RSA 2048 M03	`2023-11-27` - `2024-12-23`	a year	crt.sh
ingest.sentry.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-02` - `2024-12-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Frame ID: 19474FA9F6F463776E5332719EC24CF4
Requests: 63 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

subsidyaid.com

Page URL History Show full URLs

http://ak.peethach.com/4/6960282/0.3289205788517042 Page URL
https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z... Page URL
https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z... Page URL
https://totalnicenewz.com/submenu/4662728/?rhd=1&var=6960282&var3=778880696172417352&oaid=60cb3cfa551b... Page URL
https://totalnicenewz.com/rhd?z=4662728&syncedCookie=false&rhd=true HTTP 302
https://track.additionalbenefits.org/742ca7d8-c5c4-499a-a412-67ea49912e87?zoneid=4662728&bannerid=20248186&zonety... HTTP 302
https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push... Page URL

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Page Statistics

52
Requests

94 %
HTTPS

41 %
IPv6

17
Domains

18
Subdomains

18
IPs

4
Countries

1328 kB
Transfer

1752 kB
Size

28
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ak.peethach.com/4/6960282/0.3289205788517042 Page URL
https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto= Page URL
https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2 Page URL
https://totalnicenewz.com/submenu/4662728/?rhd=1&var=6960282&var3=778880696172417352&oaid=60cb3cfa551bc66037efee4167f477f3 Page URL
https://totalnicenewz.com/rhd?z=4662728&syncedCookie=false&rhd=true HTTP 302
https://track.additionalbenefits.org/742ca7d8-c5c4-499a-a412-67ea49912e87?zoneid=4662728&bannerid=20248186&zonetype={zone_type}&campaignid=7898133&device=desktop&region=tx&isp=781237823&source=PR2&medium=push&cost=0.013045&visitor_id=778880707580928499 HTTP 302
https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

52 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK 0.3289205788517042
ak.peethach.com/4/6960282/ 2 KB
2 KB 289ms
244ms Document
text/html 23.12.146.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: http://ak.peethach.com/4/6960282/0.3289205788517042
Protocol: HTTP/1.1
Server: 23.12.146.138 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-12-146-138.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace Accept, Content-Type, Content-Length, Accept-Encoding, favicon
Access-Control-Allow-Methods: GET, POST, OPTIONS POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Origin: * *
Access-Control-Max-Age: 86400
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 725
Content-Type: text/html; charset=utf8
Date: Tue, 06 Feb 2024 23:45:47 GMT
Expires: Tue, 06 Feb 2024 23:45:47 GMT
Link: <https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch" <https://totalnicenewz.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
Pragma: no-cache
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Trace-Id: 281d383f42c8cef1d1604dd8b0341aa8

POST img.gif
my.rtmark.net/ 0
0

GET
H2 200 / Show response
totalnicenewz.com/ 40 KB
14 KB 567ms
168ms Document
text/html 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Requested by: Host: ak.peethach.com
URL: http://ak.peethach.com/4/6960282/0.3289205788517042
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 1c063e39d0b354454854157d628271793159f4f816afca372f8b2f538a4f70a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 851744d44ca636c2-YYZ
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 06 Feb 2024 23:45:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hboegOdbmfTpVUeJf69lIR5R0JlhMeVC3DfWSDfR8c1NDj6qlXnE%2FHsUxD1%2Fqs8Lmcfjo8cNb7BvPAlAvEr89W%2BRLgI%2BN3PBTMhVzaFRBWu04o9IzMIGFoHgLlJq%2B7lly%2BLzvg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
545 B 105ms
105ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?userId=60cb3cfa551bc66037efee4167f477f3

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

e50f69e16dd48386a178cca65ed5320268160d9b1bb1356075b9427d6a3d1e3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:48 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://totalnicenewz.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H2 200 micro.tag.min.js Show response
totalnicenewz.com/pfe/current/ 28 KB
11 KB 224ms
223ms Script
application/javascript 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1
Requested by: Host: totalnicenewz.com
URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc5f2967a33d6cd3df5091e31bd1fecb3d19094ba3f563fe26287a8ce7117b7f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 23:45:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 25 Jan 2024 09:37:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65b22bc5-704a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HnhWIeZ6zIEv9hXCNdCrYJ5Sf%2BWkCmyZ0V81BKqmsqW1CD6PlwS4whdzkk3EaVd0rz%2BZsb%2Ftda4FMrLZY%2BanZsunFo%2FsUUThdJxVSiY8GbnAhNC3RzGu22dnM4jgM3P6JQDpbg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 851744d58f4e36c2-YYZ
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 327 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 / Show response
totalnicenewz.com/19/4662728/ 3 KB
3 KB 131ms
130ms XHR
application/json 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalnicenewz.com/19/4662728/?abt_opts=1&var=6960282&var3=778880696172417352&ymid=&rhd=1

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

376b128c2f936d7ad834912384cd14212c3c799f1640bd3a26638e6e7ce98f4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:48 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: 5b2edfe779f987527a5931e652677607
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D6HaeimeldyFk5zMU8EtzaOO5UWdhYYgzpp0DeglWz63I2e2WQzIKnW3KMaV4lbxNv22R8pwsEwz%2Bg9GHkMeapcZTKh1xDHuTSbYniOR9aZznLODnFegheF2W5IU5Ptc%2F8mh9A%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 851744d58f6636c2-YYZ
expires: Tue, 11 Jan 1994 10:00:00 GMT

POST
H2 200 / Show response
totalnicenewz.com/ 2 B
369 B 134ms
133ms XHR
application/json 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&mprtr=1
Requested by: Host: totalnicenewz.com
URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.27
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:48 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.27
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FIXdvVbMhdZ2tnObCdkLNAlCdeli5Y9boVj06qcRDMOj80t3IUANCNt%2BUlpwANwkqO3Ksidb6U9V3hwIZtrrsoZdWEJNK42guxRfTqe6lhoNi29MAzxidPSOjDwzO9CthyOGpA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 851744d58f7736c2-YYZ
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc: h3=":443"; ma=86400

GET
H3 200 rhd Show response
totalnicenewz.com/ 3 KB
3 KB 135ms
134ms Fetch
application/json 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalnicenewz.com/rhd?rb=OA-lPNiW6aM6Q42HH6mgxP25IBznDoJD5hoLwllPQF77R89xqsyFrP2pa4h4g7kPJIE5gUoNZVxM1qtyxZR1oPZXA8CzHrml8MG6_vHRJ116kHxRcqtjMADlLg1eqgQKy-prtobQs80mUWEqPkm8SqWFwlNUERfmHNOfywgm0VYBtuZf2oUEK0Ii7QmYJvIFGt3P0lLU7MDeohXlmPYqNjO_t3Hw_5_bqEBIVNMiJ6y50Xr7IFSEmB7SEqMCOuCN0TSyEEui4xCrwFp0V4ri-o8BlkeJ6NfncwWFK7TWT_H-do1EzX5nFE2OOD6n3g5TemW7YO1tbGjHDkn4I0J1JlVgn5l10kQQld8_qyyNFV6BLPc-bn2JO7arnsZc6CI8Dh92Jb2qv0dNOLpfLegd-XUanz8NKPBeUT4yjki3r7nMq68n4gYl-8HVk6hBc9JbQP8wvISuRLH8919r3_MBY-FhEzwuBjx7e2QNakAn1vVdJdeB9PVPXriRzxCGQ7UQ5ZABwf06CPGkrUwrso2yCiMUclfuDMZ3&request_ab2=0&zoneid=4662728&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wih=1200&wiw=1600&wfc=0&pl=https%3A%2F%2Ftotalnicenewz.com%2F%3Fs%3D778880696172417352%26ssk%3De48d1e0c0346bb1ee14e71acf655dda1%26svar%3D1707263147%26z%3D6960282%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb%26btz%3D%26bto%3D&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-unknown&var=6960282&var3=778880696172417352&ymid=&rhd=1&m=link

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0f16907a1ac8e0741cf26de718ac1e03a7873d261e15a3433837e3030d91a66

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:48 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: 05b159eee0bbdd44feb7df58cf53149a
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VY61rJ9PeymREQ6hr%2FH2vJ2SRdKPPfHYpYCE22iG4B97%2Fq%2FDY%2FfCjJ18gp3tQnZrTBG8AjYj8fzku9dE2zhQDbGogKxe7v9U%2B%2BJo%2BNKE8Qh869PS0SrCJpm6FT1aziID7KASKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 851744d66fc7542b-YYZ
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H3 200 4662709
totalnicenewz.com/sw-check-permissions/ 0
960 B 138ms
137ms Other
application/javascript 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalnicenewz.com/sw-check-permissions/4662709?var=6960282&ymid=778880696172417352&uhd=1&zoneId=4662709
Requested by: Host: totalnicenewz.com
URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:48 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FIBUIrE9gaFZc2C%2F0Z54cedRzY%2Bx6eET0sXIj847yDNhSgZkejUTzND5NcU1F6Ubwk3mmRxYskPP9UwAgNB0E9SilPMHogz7d%2F7GK%2BtTJIKRGe%2BDZVZJDJQiLBxwfz9FI6v8cQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray: 851744d6f8c0542b-YYZ
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400

POST
H3 200 zone
totalnicenewz.com/ 0
495 B 214ms
214ms Ping
text/plain 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalnicenewz.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=totalnicenewz.com&var=6960282&ymid=778880696172417352&var_3=&var_4=&dsig=&tg=1&sw=3.1.477&trace_id=dc8d920b-46ef-4223-ad58-1d5744e6b5d9&action=prerequest&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-trace-id: 944c54d7fc06178f986383ac30fad759
date: Tue, 06 Feb 2024 23:45:48 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OBDfP%2BdZZZF0nqqyZ3wenmoox7zqrKhOTJWV2sE9qdwbPfbEC6HWXAbzip9WTp9z3OyaUKXAGL%2BkFjtmW4%2FuXwpkvlW9pZEruILGlsZwR8RYeZnzHOqhrlsmLe6wwVh3WiyoJw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://totalnicenewz.com
access-control-allow-credentials: true
cf-ray: 851744d708c9542b-YYZ
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
545 B 106ms
105ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=778880696172417352&var=6960282

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

e50f69e16dd48386a178cca65ed5320268160d9b1bb1356075b9427d6a3d1e3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:48 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://totalnicenewz.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H3 200 zone
totalnicenewz.com/ 794 B
985 B 122ms
121ms Fetch
application/json 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalnicenewz.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=totalnicenewz.com&var=6960282&ymid=778880696172417352&var_3=&var_4=&dsig=&tg=1&sw=3.1.477&trace_id=dc8d920b-46ef-4223-ad58-1d5744e6b5d9&action=settings&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:48 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-trace-id: e20dab7989ba0652a217b997d4f640ac
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wjpyS9xoLtr%2BRL%2FoPlJg6LJqo3ChVoo9gsEpRFumT4%2BEDMaDiXiIrDLNrvSQN%2BB4RnUKHvmoJOjxSZhn4%2BAtlGfkFdsRU9bUYkwXvqaMCH9THOKe6UeoWoEOE0KMq0D319s4Mg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 851744d718eb542b-YYZ
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept

GET
H3 200 / Show response
totalnicenewz.com/ 40 KB
14 KB 166ms
165ms Document
text/html 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Requested by: Host: totalnicenewz.com
URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 13d0809b84c5eb5e2f7a112e5d79e772a7ad30e28e6e53a4aab17cd7d0e475e4

Request headers

Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 851744d7b9fa542b-YYZ
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 06 Feb 2024 23:45:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q3XORXh7VTgy8SBj5chcgIynE80QnILhffbX%2BiJqQa0RsAzmZlochB0yH7%2B8VIMvCpaUyfP0blE6pkw%2FT8Or4HG4wYcSYMmEh%2Bg1E%2BlObRM3G3NdZ6m3bCdYkET3B4zJGJ9tMw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

GET
H3 200 micro.tag.min.js Show response
totalnicenewz.com/pfe/current/ 28 KB
11 KB 275ms
274ms Script
application/javascript 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1
Requested by: Host: totalnicenewz.com
URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc5f2967a33d6cd3df5091e31bd1fecb3d19094ba3f563fe26287a8ce7117b7f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 23:45:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 25 Jan 2024 09:37:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65b22bc5-704a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IZSPd64l2yqRzz5nqqb8XOh%2BGj8wxo1Z09f1FvRUZWepEiE75Y5uziG2Z8z6Y%2FGUjFHRjKnzsfzVRf0hn686PdJq82r6lJNZMgN4PbiqAXtcN7q4KNirQwVYT%2FpyCkE3%2F1zuSA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 851744d8dc81542b-YYZ
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 327 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 / Show response
totalnicenewz.com/19/4662728/ 3 KB
3 KB 271ms
270ms XHR
application/json 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalnicenewz.com/19/4662728/?abt_opts=1&var=6960282&var3=778880696172417352&ymid=&rhd=1

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c93573454b67263ffbeb58db468a33ab825c8399a0431e5334fae02d51f483ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:49 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: 4fb729f2c91643460ededddfc202321b
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uhOidpL94DtjoS549joIJGcNXDv%2BTf1KhSJ1g2mOy5f1mtrVeSZTWlSFAbBGPQULkk8%2BwNY7xsvpWz64A9dHjihTf3mG7rPn4j27%2Fw219C8jp2BikozAA8ij2fB8D1d6Vxxfxg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 851744d8dc85542b-YYZ
expires: Tue, 11 Jan 1994 10:00:00 GMT

POST
H3 200 / Show response
totalnicenewz.com/ 2 B
533 B 264ms
264ms XHR
application/json 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2&mprtr=1
Requested by: Host: totalnicenewz.com
URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:49 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xRUhly0%2FpmwyX570LDvlGwVOskJMkp2VXcmD8%2F23zb4NjpfGcwMZlP%2B05oAZqCtFKdCsXsELXg1rhZj4owPNyiGZO2R9PLhCeJYfVWR2nN05F2MhwqlcWBTJTIs915FTjjz%2FiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 851744d8ec99542b-YYZ
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc: h3=":443"; ma=86400

GET
H3 200 4662709
totalnicenewz.com/sw-check-permissions/ 0
953 B 122ms
122ms Other
application/javascript 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalnicenewz.com/sw-check-permissions/4662709?var=6960282&ymid=778880696172417352&uhd=1&zoneId=4662709
Requested by: Host: totalnicenewz.com
URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:49 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vMhJgoIyvj4WwANBez4x7PTljUQN5VNusrRcMS8%2Fj%2B5sBxPtbGSwVhq1ugaQ5g7Z6zk2pYurEIuHue15VuzNQ337PQxja5NcSZ7n57cyPqzLLPpp9RL4ovlH0aMUuh6swnM0PQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray: 851744daafc5542b-YYZ
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400

POST
H3 200 zone
totalnicenewz.com/ 0
497 B 129ms
128ms Ping
text/plain 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalnicenewz.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=totalnicenewz.com&var=6960282&ymid=778880696172417352&var_3=&var_4=&dsig=&tg=1&sw=3.1.477&trace_id=5af6461c-daf4-41f6-87d4-729049d61f15&action=prerequest&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-trace-id: 5ec3c0dfbaf563164a8c2668116225ac
date: Tue, 06 Feb 2024 23:45:49 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=we6Ydlnms9fYiChle7%2Fy%2FSmBYodLli8bGLjIjlT7Unit97hC3JsaReGciz%2F6UpAHuxnKXmiUqMztUH2eW7HWzGh0%2F8Wzrn%2FzV5gC36pCbQPbMUp%2FBg0oeknZJqvbt%2F8xPuMHbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://totalnicenewz.com
access-control-allow-credentials: true
cf-ray: 851744daafc7542b-YYZ
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
545 B 105ms
105ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=778880696172417352&var=6960282

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

e50f69e16dd48386a178cca65ed5320268160d9b1bb1356075b9427d6a3d1e3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:49 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://totalnicenewz.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H3 200 zone Show response
totalnicenewz.com/ 794 B
989 B 127ms
126ms Fetch
application/json 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalnicenewz.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=totalnicenewz.com&var=6960282&ymid=778880696172417352&var_3=&var_4=&dsig=&tg=1&sw=3.1.477&trace_id=5af6461c-daf4-41f6-87d4-729049d61f15&action=settings&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/pfe/current/micro.tag.min.js?z=4662709&ymid=778880696172417352&var=6960282&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8508d7dd6d7a5c2f5187c78be6c0faa8dfc1410ba34b0607fcfba052d03b701

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:49 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-trace-id: a9ca9b950603f7fbc5c21da26266c277
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iEFyAu368OUbnxgW0bSaM8KxfLGXf6aVIvC%2B%2B8gCx6w9r9MuKTyXOXxBPrlMfSz4zo8%2BEctku5CVGPRBkQI5io%2BIoykFqLuE%2Be01ISWsuZD%2BbwumKckI6EHd%2FTvwQw41cV2erg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 851744dacfef542b-YYZ
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept

GET
H3 200 / Show response
totalnicenewz.com/submenu/4662728/ 33 KB
13 KB 126ms
126ms Document
text/html 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalnicenewz.com/submenu/4662728/?rhd=1&var=6960282&var3=778880696172417352&oaid=60cb3cfa551bc66037efee4167f477f3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ea022d076d0b557c2eab6421f6564a7727697d5334b27ed461655b595f25939

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 851744de7fbc542b-YYZ
content-encoding: gzip
content-type: text/html; charset=utf8
date: Tue, 06 Feb 2024 23:45:49 GMT
expires: Tue, 11 Jan 1994 10:00:00 GMT
link: <https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V8Lkn9o6cOlgfj1wSZ%2BR%2FOmhiEcn5%2Bw0AQ2lJ0feTnUhkn9jmhC5uLwkauF0fgrQU8PfqEQWjSzHBa50%2BmXLjkSSe8wRdtpw8cQmQCT5Jnke9SWCBST4m%2FGlr7zazQaYCQLS0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=1
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-trace-id: f6360a78d81b96daddb723748ff41779

POST
H3 200 sftouch
totalnicenewz.com/ 2 B
777 B 235ms
234ms Ping
text/plain 104.21.83.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalnicenewz.com/sftouch?userId=60cb3cfa551bc66037efee4167f477f3&z=4662728&p_rid=53cbf6de-9ab1-4695-851d-cc9ea494c64a&p_src=sf&branchId=0&rb=Uwk2j2WxIxnLA6ugcfMfdHLOxCGZaLRPCVc8eeqGCbU0pVoDXqyrSXtQMOrpzO6mPuujlhS0rT8Ao6Qz--4CzsA4MsGFSYrLZXAhb3GPladKfrbir7Al5s54W_xVdJ4k0yoLTawxQRedK3V7sDbpdKQ2ItRxZtkwbLKznIJ1NgGHesdXTT9oh9OXMdBLphi2eg0DN3e_Ikvr9RN23z7yWy_RoAL6I1egDvzUEK-addP2vCIi2LBN3mSTkTeGPATH-BQddpDDl4z0CnKk7cOgcssoR0u6Egq39cqUio2ttJlJsxcVP3aS7luecCl5zgfOsp9GVw==

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/submenu/4662728/?rhd=1&var=6960282&var3=778880696172417352&oaid=60cb3cfa551bc66037efee4167f477f3

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.83.214 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/submenu/4662728/?rhd=1&var=6960282&var3=778880696172417352&oaid=60cb3cfa551bc66037efee4167f477f3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:50 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 2
x-trace-id: 0adbd81e4807665b8e4b4349aaef6a0b
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
access-control-allow-origin: https://totalnicenewz.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sqJQ%2BlekTKWh4ZGDPu8l1FLXl6%2BegdUKjoUfTUV6iJ%2FTjZfnvNgfnLFfMyXyz6jxCFoWiW6Qt%2B7I1CUkgP%2BuFL8kwsgQZFhESQIo2%2B6fvlxpV1feJH%2BeaHAVmT9xzS5aO1ZANw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 851744df69f6542b-YYZ
expires: Tue, 11 Jan 1994 10:00:00 GMT

POST
H2 200 img.gif
my.rtmark.net/ 43 B
508 B 227ms
226ms Ping
image/gif 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/img.gif?f=merge&userId=60cb3cfa551bc66037efee4167f477f3&z=4662728&p_rid=53cbf6de-9ab1-4695-851d-cc9ea494c64a&p_src=sf

Requested by

Host: totalnicenewz.com
URL: https://totalnicenewz.com/submenu/4662728/?rhd=1&var=6960282&var3=778880696172417352&oaid=60cb3cfa551bc66037efee4167f477f3

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://totalnicenewz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:50 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: image/gif
access-control-allow-origin: https://totalnicenewz.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 43

POST
H/1.1 200
OK add
datatechone.com/log/ 2 B
470 B 316ms
104ms XHR
text/plain 37.48.68.71
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=2cbfd0d0-b836-40c4-9248-e45d2b3f1690
Requested by: Host: totalnicenewz.com
URL: https://totalnicenewz.com/submenu/4662728/?rhd=1&var=6960282&var3=778880696172417352&oaid=60cb3cfa551bc66037efee4167f477f3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.48.68.71 Amsterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash

Request headers

Referer: https://totalnicenewz.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 06 Feb 2024 23:45:50 GMT
Server: nginx/1.19.10
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://totalnicenewz.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length: 2

GET
H2

200

Primary Request lander-1 Show response
equi5.subsidyaid.com/
Redirect Chain

https://totalnicenewz.com/rhd?z=4662728&syncedCookie=false&rhd=true
https://track.additionalbenefits.org/742ca7d8-c5c4-499a-a412-67ea49912e87?zoneid=4662728&bannerid=20248186&zonetype={zone_type}&campaignid=7898133&device=desktop&region=tx&isp=781237823&source=PR2&...
https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=...

1 KB
1 KB

514ms
419ms

Document
text/html

34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: d3856b4d11d76e6f4fa87973b4ec83dd6ef0e9cb6eeda65b884727f33512fc4b

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://totalnicenewz.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
content-length: 1336
content-type: text/html
date: Tue, 06 Feb 2024 23:45:51 GMT
etag: "65c173d3-538"
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3

Redirect headers

cache-control: no-store, no-cache, pre-check=0, post-check=0
content-length: 0
date: Tue, 06 Feb 2024 23:45:50 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
pragma: no-cache
server: nginx

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
847 B 108ms
41ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,300;9..40,400;9..40,500;9..40,600&display=swap

Requested by

Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83b78ab2ca543f34ac77a105efaff8fd77bbdba44939b8be442a1bcc85f14cb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 23:45:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 23:24:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 23:45:51 GMT

GET
H2 200 scripts.js Show response
equi5.subsidyaid.com/scripts/ 12 KB
12 KB 93ms
91ms Script
application/javascript 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://equi5.subsidyaid.com/scripts/scripts.js
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: b416c2ebf4b4d4e71bd515a35a15f45da09c708728cfedb05dc3ed2902fc68dd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-2e69"
content-length: 11881
content-type: application/javascript

GET
H2 200 main.8472d217.js Show response
equi5.subsidyaid.com/static/js/ 776 KB
777 KB 45ms
44ms Script
application/javascript 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://equi5.subsidyaid.com/static/js/main.8472d217.js
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: 176f2cb0f7d0d607cf3903b22162cec1387e1cfbf363d76b29a2870ee1146128

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-c1ea1"
content-length: 794273
content-type: application/javascript

GET
H2 200 main.6df79cac.css
equi5.subsidyaid.com/static/css/ 17 KB
17 KB 92ms
91ms Stylesheet
text/css 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://equi5.subsidyaid.com/static/css/main.6df79cac.css
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: 7ee7f061f864c34e21a8a9c0a753ec7e61415a7032fc0b04cc784c0134956db0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-43ca"
content-length: 17354
content-type: text/css

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
58 KB 220ms
33ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/scripts/scripts.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bca51ed2fe251488a1b150edf560d43880f1486740f34d24120ede486f99676b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 06 Feb 2024 23:45:51 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57257
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: 2sWXGOujoN9RIG7HfBYRbT0665ekNe65E7rlC3ejiTrSCUC8PJA3wHnTQFhX4lJXlbHWTD7FYDH90WRQA9Pecw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 117 KB
45 KB 225ms
41ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-W8XQHMBR

Requested by

Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/scripts/scripts.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1b1f1acde594b86a71cf69909656fee64c8207f24e6b594cb82f967033a98a8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46058
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 22:18:26 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 06 Feb 2024 23:45:51 GMT

GET
H2 200 banner_shape_3.6cde1a3669b1a621d6e6.webp
equi5.subsidyaid.com/static/media/ 58 KB
58 KB 45ms
45ms Image
image/webp 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/banner_shape_3.6cde1a3669b1a621d6e6.webp
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/static/css/main.6df79cac.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: fbefb53e718f4e5f3c2d02656af3678f10b9388a82511855617830f58cd98f61

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/static/css/main.6df79cac.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-e908"
content-length: 59656
content-type: image/webp

GET
H2 200 rP2Hp2ywxg089UriCZOIHQ.woff2
fonts.gstatic.com/s/dmsans/v14/ 61 KB
62 KB 130ms
62ms Font
font/woff2 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/dmsans/v14/rP2Hp2ywxg089UriCZOIHQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,300;9..40,400;9..40,500;9..40,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef3e7e94fc36d961b807c8fa6c2bbbd5cf60a746a95c0d01f331d847156b198c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://equi5.subsidyaid.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62704
x-xss-protection: 0
last-modified: Wed, 12 Jul 2023 22:05:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 23:45:51 GMT

GET
H2 200 logo.46a0b122f586f8f63c5a.png
equi5.subsidyaid.com/static/media/ 38 KB
38 KB 46ms
45ms Image
image/png 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/logo.46a0b122f586f8f63c5a.png
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: ef6ebebb5f3b1f249439235c20ce8b7b4da09b4865c7e02cc508b70bfaf54cf9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-97df"
content-length: 38879
content-type: image/png

GET
H2 200 subsidycard.b137d19491cceaeca436.webp
equi5.subsidyaid.com/static/media/ 28 KB
28 KB 47ms
46ms Image
image/webp 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/subsidycard.b137d19491cceaeca436.webp
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: 1121f900845e1e1d10a24d0ebeca2cba7980de8b55118546879a2e1a54b638d9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-6ffc"
content-length: 28668
content-type: image/webp

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a65df679865cbe83d89e0edcd0f684ea66169fedee5b420cf1b6544e9fa13845

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 news-logo02.ec6acd0201605b43bc54.png
equi5.subsidyaid.com/static/media/ 23 KB
23 KB 47ms
47ms Image
image/png 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/news-logo02.ec6acd0201605b43bc54.png
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: 0e4b455181a5b285f26758971d8f0b47ee821307adfbf91b6c75602f50c94a0d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-5c8e"
content-length: 23694
content-type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 74e959bdf6b08b492e3b51a00f380ec6dc909967a3e3bdc62f90f9921c77d251

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa9bb74cb885084014960f08e9bcd5fff5eaff8575dc00dd3e70d0a21a426a4a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e7ac9ad730d43956d46938079899f41f83714aa8e8affc90186373773c528706

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 news-logo06.0fc68c2f7481ac435f98.png
equi5.subsidyaid.com/static/media/ 22 KB
22 KB 47ms
44ms Image
image/png 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/news-logo06.0fc68c2f7481ac435f98.png
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: dbc384bd02b57754a0bfab2891767aa3fa65100af6f9e7947c09eef292606d0f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-5909"
content-length: 22793
content-type: image/png

GET
H2 200 002-basket.8e956a38db2baa6a51c4.webp
equi5.subsidyaid.com/static/media/ 6 KB
6 KB 48ms
45ms Image
image/webp 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/002-basket.8e956a38db2baa6a51c4.webp
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: 5b8e5d2f27e9fb10aae3edb56fc9134aed9ab59317b7a1fbc7f19bdaca05ffbc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-1914"
content-length: 6420
content-type: image/webp

GET
H2 200 003-rent.90b97597dfbe45996927.webp
equi5.subsidyaid.com/static/media/ 3 KB
3 KB 48ms
46ms Image
image/webp 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/003-rent.90b97597dfbe45996927.webp
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: 41c5942b665b0d689809e54ad42a829ad7d05b465da0ef6a6834a73f3b40e6b3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-a12"
content-length: 2578
content-type: image/webp

GET
H2 200 001-gas-pump.da372692325fa1463351.webp
equi5.subsidyaid.com/static/media/ 3 KB
4 KB 66ms
64ms Image
image/webp 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/001-gas-pump.da372692325fa1463351.webp
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: 07edc267cf6450c21b85b43d498632665b785593860e4ea9911219d890179863

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-d8a"
content-length: 3466
content-type: image/webp

GET
H2 200 004-online-shopping.014c367a742b5cbdcff8.webp
equi5.subsidyaid.com/static/media/ 3 KB
3 KB 66ms
65ms Image
image/webp 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/004-online-shopping.014c367a742b5cbdcff8.webp
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: ddb682b2e3d2ac7f1e637ed27a3b98f4b88145dd09742da03c35ee597b1df525

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-b72"
content-length: 2930
content-type: image/webp

GET
H2 200 trustpilot-logo.228391ce98bdfb1e17b4.png
equi5.subsidyaid.com/static/media/ 67 KB
68 KB 67ms
65ms Image
image/png 34.123.196.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://equi5.subsidyaid.com/static/media/trustpilot-logo.228391ce98bdfb1e17b4.png
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.123.196.68 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.196.123.34.bc.googleusercontent.com
Software: nginx/1.25.3 /
Resource Hash: ddf815a7a7b5ad1e87132638f5d141599075d6f61a5700e21dfd5e44209253ba

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:51 GMT
last-modified: Mon, 05 Feb 2024 23:48:35 GMT
server: nginx/1.25.3
accept-ranges: bytes
etag: "65c173d3-10dd6"
content-length: 69078
content-type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e53d918f1e31a51d64f9780fa1c4d91fcac71db9c13fcb9194d633213158bc7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 813 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee82b191319cab951f67e31261e7c36a53bc0b49fe818f7523614140385b4c2e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02643c4790593efc994305a03557d68b339e66b3e1dbd390ff10726430dea506

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3b59ed497b64917f794e3ee961cbf9dfc4ff6ca5033f9b28d8e76b0c0a2623d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
BLOB 200
OK 2bf6328e-b5a0-48a9-8601-0b053880661a
https://equi5.subsidyaid.com/ 10 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://equi5.subsidyaid.com/2bf6328e-b5a0-48a9-8601-0b053880661a
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/lander-1?vl_click_id=wlpvonqqv9466f0v2tbd1s3q&utm_source=PR2&utm_medium=push&utm_campaign=7898133&utm_adset=781237823&utm_ad=20248186&site_id=%7Bzone_type%7D&placement=4662728&externalclickid=778880707580928499
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ca3d44191e822500b330ae74a7b981fddc94188da2e683a1e1508fd188d2b1b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Length: 10285
Content-Type

GET
H2 200 ringba.com.js Show response
js.callcdn.com/js_v3/min/ 7 KB
3 KB 136ms
35ms Script
application/javascript 2600:9000:20ed:c800:9:5bab:8100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.callcdn.com/js_v3/min/ringba.com.js
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/static/js/main.8472d217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ed:c800:9:5bab:8100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1b35261b95ec779b25d6a27b1b2c1c2d6f1c08f329ffd643478ad63d7ddcdea0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 12:14:59 GMT
content-encoding: gzip
via: 1.1 1f53e7c3ff322fe2a87e3b0e12a1a5b8.cloudfront.net (CloudFront)
last-modified: Wed, 10 Jan 2024 15:58:04 GMT
server: Microsoft-IIS/10.0
x-amz-cf-pop: PHL50-C1
age: 41705
x-powered-by: ASP.NET
etag: W/"0ce63cbdd43da1:0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: aD0fP4_SYU26hegEWeapiRiua_H8BxLPavcZmrR2rLNrXcgSNW3bKg==

GET
H/1.1 200
OK / Show response
api.ipify.org/ 20 B
220 B 273ms
88ms XHR
application/json 104.237.62.212
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/static/js/main.8472d217.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.237.62.212 El Segundo, United States, ASN18450 (WEBNX, US),
Reverse DNS: api.ipify.org
Software: nginx/1.25.2 /
Resource Hash: 5995c0014a72b690d3f712a453b7b047e3501caf03c2e2bc5c6ae21573e44ca3

Request headers

Accept: application/json, text/plain, */*
Referer: https://equi5.subsidyaid.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 06 Feb 2024 23:45:51 GMT
Server: nginx/1.25.2
Connection: keep-alive
Content-Length: 20
Vary: Origin
Content-Type: application/json

GET
H2 200 volumOfferScript.js Show response
lander-main-microservice.netlify.app/ 2 KB
993 B 105ms
32ms Script
application/javascript 2600:1f18:16e:df02::64
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://lander-main-microservice.netlify.app/volumOfferScript.js

Requested by

Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/static/js/main.8472d217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:16e:df02::64 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Netlify /

Resource Hash

789b421b522b89a400280aaaed0096fb4c36e54da676914528442495abe7d782

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nf-request-id: 01HP0D0KNRSTQJ9CMXEC6KGECT
date: Tue, 06 Feb 2024 23:45:51 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: Netlify
age: 78743
cache-status: "Netlify Edge"; hit
etag: "93347be9e14a8b56ff0067ca578bcc32-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 722

GET
H2 200 ip Show response
funnel.improveourcredit.com/ 2 KB
2 KB 480ms
136ms XHR
application/json 104.154.135.87
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://funnel.improveourcredit.com/ip?key=askdjaslkdjaskjdsla
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/static/js/main.8472d217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.154.135.87 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 87.135.154.104.bc.googleusercontent.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 6d2b583911ed99004856d13b6bfc660f98ec41e1c610a756607293f85b00112e

Request headers

Accept: application/json, text/plain, */*
Referer: https://equi5.subsidyaid.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:45:52 GMT
server: nginx/1.18.0 (Ubuntu)
x-powered-by: Express
etag: W/"6b7-mLJ01VDI2BVeAx7cBd1Yidj0keg"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
content-length: 1719

GET
H2 200 1279112236350881 Show response
connect.facebook.net/signals/config/ 53 KB
11 KB 33ms
32ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1279112236350881?v=2.9.145&r=stable&domain=equi5.subsidyaid.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f256c7613955dae449b7ba9d1f3be745949c30db8135da14b58a2ea2193f4652

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 06 Feb 2024 23:45:51 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 11162
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: x7oXFCuzkxp9+28bYo4tNK7rmhhliz8kz7UQFaFyKp17DJqSr/z6ul95vWEDBa9cJKgKBEfPM+S8m5VFAx2cBw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1814a508923b1abe4c79182d2533c2f8d852ede8799de0e0c115e431cd20e774

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 109ms
32ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1279112236350881&ev=PageView&dl=https%3A%2F%2Fequi5.subsidyaid.com%2Flander-1%3Fvl_click_id%3Dwlpvonqqv9466f0v2tbd1s3q%26utm_source%3DPR2%26utm_medium%3Dpush%26utm_campaign%3D7898133%26utm_adset%3D781237823%26utm_ad%3D20248186%26site_id%3D%257Bzone_type%257D%26placement%3D_removed_%26externalclickid%3D778880707580928499%26_filteredParams%3D%257B%2522unwantedParams%2522%253A%255B%255D%252C%2522restrictedParams%2522%253A%255B%25221480fb125459cbca6cff13fbac5d846220d91cf906e466eb2842ef350878138b%2522%255D%257D&rl=&if=false&ts=1707263151797&cd[eventID]=EVENT_ID7C40DEFA-C6AE-407E-891B-EC2CA8BBCD53.AE99914C-5B25-4711-A607-65118DD7609B&sw=1600&sh=1200&v=2.9.145&r=stable&ec=0&o=4126&fbp=fb.1.1707263151793.1631859480&ler=empty&cdl=API_unavailable&it=1707263151740&coo=false&up_url=&rp_url=1480fb125459cbca6cff13fbac5d846220d91cf906e466eb2842ef350878138b&exp=e1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 06 Feb 2024 23:45:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 .js Show response
track.subsidyaid.com/d/ 1 KB
1 KB 132ms
42ms Script
application/javascript 34.232.110.131
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://track.subsidyaid.com/d/.js?oref=&ourl=https%3A%2F%2Fequi5.subsidyaid.com%2Flander-1%3Fvl_click_id%3Dwlpvonqqv9466f0v2tbd1s3q%26utm_source%3DPR2%26utm_medium%3Dpush%26utm_campaign%3D7898133%26utm_adset%3D781237823%26utm_ad%3D20248186%26site_id%3D%257Bzone_type%257D%26placement%3D4662728%26externalclickid%3D778880707580928499&opt=subsidyaid.com&vtm=1707263151816
Requested by: Host: lander-main-microservice.netlify.app
URL: https://lander-main-microservice.netlify.app/volumOfferScript.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.232.110.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-110-131.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e6800e90553c9cb5a3bd8bb63f5149d48b30ed8046dc32275bccd0d91631d7a0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://equi5.subsidyaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 23:45:51 GMT
server: nginx
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, pre-check=0, post-check=0
content-length: 1150
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 200
OK gnbulk Show response
display.ringba.com/v2/nis/ 398 B
789 B 166ms
43ms XHR
application/json 54.197.77.77
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://display.ringba.com/v2/nis/gnbulk
Requested by: Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/static/js/main.8472d217.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.197.77.77 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-197-77-77.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 64884742d870ac517484e28cb2cce4259637d3c5802373a8dc2095ba29fb254b

Request headers

Referer: https://equi5.subsidyaid.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 23:45:51 GMT
X-Runtime: 0.0020
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Max-Age: 300
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://equi5.subsidyaid.com
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 398
Expires: -1

POST
H2 429 / Show response
o4506236711272448.ingest.sentry.io/api/4506247999520768/envelope/ 198 B
590 B 340ms
85ms Fetch
application/json 34.120.195.249

General

Check archive.org

Show headers Download Go to

Full URL

https://o4506236711272448.ingest.sentry.io/api/4506247999520768/envelope/?sentry_key=af570c650df8c0a8b2bf41eb906104b8&sentry_version=7&sentry_client=sentry.javascript.react%2F7.80.1

Requested by

Host: equi5.subsidyaid.com
URL: https://equi5.subsidyaid.com/static/js/main.8472d217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.195.249 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

bac10d17440dcd6f6c6c4e0bd7eca2e1a7eec030ef3b1143d4be3791dcf91263

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://equi5.subsidyaid.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 06 Feb 2024 23:45:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
server: nginx
vary: origin,access-control-request-method,access-control-request-headers
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time: 3
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 198
x-sentry-rate-limits: 60:transaction;profile:organization:transaction_usage_exceeded
retry-after: 60

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: my.rtmark.net
URL: https://my.rtmark.net/img.gif?f=merge&userId=76eb21efda1245568c69210f00efac76

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

28 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
ak.peethach.com/	1970-01-21 02:59:59	Name: OAID Value: 76eb21efda1245568c69210f00efac76
ak.peethach.com/	1970-01-21 02:59:59	Name: oaidts Value: 1707263147
totalnicenewz.com/	1970-01-21 02:59:59	Name: OAID Value: 60cb3cfa551bc66037efee4167f477f3
my.rtmark.net/	1970-01-21 02:59:59	Name: ID Value: 60cb3cfa551bc66037efee4167f477f3
totalnicenewz.com/	1970-01-20 18:24:27	Name: syncedCookie Value: true
totalnicenewz.com/	1970-01-20 18:14:23	Name: prefetchAd_4662728 Value: true
totalnicenewz.com/	1970-01-20 18:14:26	Name: reverse Value: dS1WEGCpiWEYhJPrt4-3u-9GxwD4khXteXeervazOJ8
totalnicenewz.com/	1970-01-21 02:59:59	Name: oaidts Value: 1707263149
.track.additionalbenefits.org/	1970-01-20 18:15:49	Name: 742ca7d8-c5c4-499a-a412-67ea49912e87-v4 Value: S6ugbBXnvktEuvKoLaqWzCXRzBgSS5iGKwaeEDpkUFI
.track.additionalbenefits.org/	1970-01-21 02:59:59	Name: cc-v4 Value: nFKIer7F26WV3iT9MF0eDDBmlih6ZgSuCsJHfYTCTH562KPW0EaxyGwl1v020n1bEFp20GIVx0ZTVOsK331cr0z7HcPqdtkPnJ%2Bl4sgM0uOamR1nKL4zd6rn%2B%2FTBxTPuBA9zxUu%2BD4FephXKWMcLuQ%3D%3D
equi5.subsidyaid.com/	1969-12-31 23:59:59	Name: eventID Value: EVENT_ID7C40DEFA-C6AE-407E-891B-EC2CA8BBCD53.AE99914C-5B25-4711-A607-65118DD7609B
.equi5.subsidyaid.com/	1969-12-31 23:59:59	Name: eventID Value: EVENT_ID7C40DEFA-C6AE-407E-891B-EC2CA8BBCD53.AE99914C-5B25-4711-A607-65118DD7609B
.equi5.subsidyaid.com/	1969-12-31 23:59:59	Name: visitor_id Value: VISITOR_ID8CB7E34D-70C9-4FE4-A45D-A797D2F122EB.5732C079-69F4-4F7E-884B-97CE22DA5C2A
.subsidyaid.com/	1969-12-31 23:59:59	Name: eventID Value: EVENT_ID7C40DEFA-C6AE-407E-891B-EC2CA8BBCD53.AE99914C-5B25-4711-A607-65118DD7609B
equi5.subsidyaid.com/	1969-12-31 23:59:59	Name: gclid Value: null
.subsidyaid.com/	1969-12-31 23:59:59	Name: gclid Value: null
equi5.subsidyaid.com/	1969-12-31 23:59:59	Name: grbaid Value: null
.subsidyaid.com/	1969-12-31 23:59:59	Name: grbaid Value: null
equi5.subsidyaid.com/	1969-12-31 23:59:59	Name: wbraid Value: null
.subsidyaid.com/	1969-12-31 23:59:59	Name: wbraid Value: null
equi5.subsidyaid.com/	1969-12-31 23:59:59	Name: acc_id Value: null
.subsidyaid.com/	1969-12-31 23:59:59	Name: acc_id Value: null
equi5.subsidyaid.com/	1969-12-31 23:59:59	Name: placement Value: 4662728
.subsidyaid.com/	1969-12-31 23:59:59	Name: placement Value: 4662728
equi5.subsidyaid.com/	1969-12-31 23:59:59	Name: visitor_id Value: [object%20Object]
.subsidyaid.com/	1969-12-31 23:59:59	Name: visitor_id Value: [object%20Object]
.subsidyaid.com/	1970-01-20 20:23:59	Name: _fbp Value: fb.1.1707263151793.1631859480
equi5.subsidyaid.com/	1970-01-21 02:59:59	Name: vl-cid Value: wlpvonqqv9466f0v2tbd1s3q

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto= Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto= Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto= Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto= Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://totalnicenewz.com/?s=778880696172417352&ssk=e48d1e0c0346bb1ee14e71acf655dda1&svar=1707263147&z=6960282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://totalnicenewz.com/afu.php?zoneid=4662728&var=4662728&rid=01rRcJlUYhuPvc1Bl3BO0Q%3D%3D&rhd=true Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://totalnicenewz.com/afu.php?zoneid=4662728&var=4662728&rid=01rRcJlUYhuPvc1Bl3BO0Q%3D%3D&rhd=true Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/1279112236350881?v=2.9.145&r=stable&domain=equi5.subsidyaid.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 95) Message: Unrecognized feature: 'attribution-reporting'.
network	error	URL: https://o4506236711272448.ingest.sentry.io/api/4506247999520768/envelope/?sentry_key=af570c650df8c0a8b2bf41eb906104b8&sentry_version=7&sentry_client=sentry.javascript.react%2F7.80.1 Message: Failed to load resource: the server responded with a status of 429 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ak.peethach.com
api.ipify.org
connect.facebook.net
datatechone.com
display.ringba.com
equi5.subsidyaid.com
fonts.googleapis.com
fonts.gstatic.com
funnel.improveourcredit.com
js.callcdn.com
lander-main-microservice.netlify.app
my.rtmark.net
o4506236711272448.ingest.sentry.io
totalnicenewz.com
track.additionalbenefits.org
track.subsidyaid.com
www.facebook.com
www.googletagmanager.com
my.rtmark.net
104.154.135.87
104.21.83.214
104.237.62.212
139.45.195.8
23.12.146.138
2600:1f18:16e:df02::64
2600:9000:20ed:c800:9:5bab:8100:93a1
2607:f8b0:4004:c06::5e
2607:f8b0:4004:c09::5f
2607:f8b0:4004:c19::61
2a03:2880:f003:c0e:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
34.120.195.249
34.123.196.68
34.232.110.131
37.48.68.71
54.197.77.77
02643c4790593efc994305a03557d68b339e66b3e1dbd390ff10726430dea506
07edc267cf6450c21b85b43d498632665b785593860e4ea9911219d890179863
0e4b455181a5b285f26758971d8f0b47ee821307adfbf91b6c75602f50c94a0d
1121f900845e1e1d10a24d0ebeca2cba7980de8b55118546879a2e1a54b638d9
13d0809b84c5eb5e2f7a112e5d79e772a7ad30e28e6e53a4aab17cd7d0e475e4
176f2cb0f7d0d607cf3903b22162cec1387e1cfbf363d76b29a2870ee1146128
1814a508923b1abe4c79182d2533c2f8d852ede8799de0e0c115e431cd20e774
1b1f1acde594b86a71cf69909656fee64c8207f24e6b594cb82f967033a98a8f
1b35261b95ec779b25d6a27b1b2c1c2d6f1c08f329ffd643478ad63d7ddcdea0
1c063e39d0b354454854157d628271793159f4f816afca372f8b2f538a4f70a4
2ca3d44191e822500b330ae74a7b981fddc94188da2e683a1e1508fd188d2b1b
2ea022d076d0b557c2eab6421f6564a7727697d5334b27ed461655b595f25939
376b128c2f936d7ad834912384cd14212c3c799f1640bd3a26638e6e7ce98f4a
41c5942b665b0d689809e54ad42a829ad7d05b465da0ef6a6834a73f3b40e6b3
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc
5995c0014a72b690d3f712a453b7b047e3501caf03c2e2bc5c6ae21573e44ca3
5b8e5d2f27e9fb10aae3edb56fc9134aed9ab59317b7a1fbc7f19bdaca05ffbc
5e53d918f1e31a51d64f9780fa1c4d91fcac71db9c13fcb9194d633213158bc7
64884742d870ac517484e28cb2cce4259637d3c5802373a8dc2095ba29fb254b
6d2b583911ed99004856d13b6bfc660f98ec41e1c610a756607293f85b00112e
74e959bdf6b08b492e3b51a00f380ec6dc909967a3e3bdc62f90f9921c77d251
789b421b522b89a400280aaaed0096fb4c36e54da676914528442495abe7d782
7ee7f061f864c34e21a8a9c0a753ec7e61415a7032fc0b04cc784c0134956db0
83b78ab2ca543f34ac77a105efaff8fd77bbdba44939b8be442a1bcc85f14cb2
a65df679865cbe83d89e0edcd0f684ea66169fedee5b420cf1b6544e9fa13845
b0f16907a1ac8e0741cf26de718ac1e03a7873d261e15a3433837e3030d91a66
b3b59ed497b64917f794e3ee961cbf9dfc4ff6ca5033f9b28d8e76b0c0a2623d
b416c2ebf4b4d4e71bd515a35a15f45da09c708728cfedb05dc3ed2902fc68dd
bac10d17440dcd6f6c6c4e0bd7eca2e1a7eec030ef3b1143d4be3791dcf91263
bca51ed2fe251488a1b150edf560d43880f1486740f34d24120ede486f99676b
c93573454b67263ffbeb58db468a33ab825c8399a0431e5334fae02d51f483ab
cc5f2967a33d6cd3df5091e31bd1fecb3d19094ba3f563fe26287a8ce7117b7f
d3856b4d11d76e6f4fa87973b4ec83dd6ef0e9cb6eeda65b884727f33512fc4b
dbc384bd02b57754a0bfab2891767aa3fa65100af6f9e7947c09eef292606d0f
ddb682b2e3d2ac7f1e637ed27a3b98f4b88145dd09742da03c35ee597b1df525
ddf815a7a7b5ad1e87132638f5d141599075d6f61a5700e21dfd5e44209253ba
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e50f69e16dd48386a178cca65ed5320268160d9b1bb1356075b9427d6a3d1e3f
e6800e90553c9cb5a3bd8bb63f5149d48b30ed8046dc32275bccd0d91631d7a0
e7ac9ad730d43956d46938079899f41f83714aa8e8affc90186373773c528706
ee82b191319cab951f67e31261e7c36a53bc0b49fe818f7523614140385b4c2e
ef3e7e94fc36d961b807c8fa6c2bbbd5cf60a746a95c0d01f331d847156b198c
ef6ebebb5f3b1f249439235c20ce8b7b4da09b4865c7e02cc508b70bfaf54cf9
f256c7613955dae449b7ba9d1f3be745949c30db8135da14b58a2ea2193f4652
f8508d7dd6d7a5c2f5187c78be6c0faa8dfc1410ba34b0607fcfba052d03b701
fa9bb74cb885084014960f08e9bcd5fff5eaff8575dc00dd3e70d0a21a426a4a
fbefb53e718f4e5f3c2d02656af3678f10b9388a82511855617830f58cd98f61

equi5.subsidyaid.com Open in urlscan Pro 34.123.196.68 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

52 Requests

94 %HTTPS

41 %IPv6

17 Domains

18 Subdomains

18 IPs

4 Countries

1328 kBTransfer

1752 kBSize

28 Cookies

0 Outgoing links

Page URL History

Redirected requests

52 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

equi5.subsidyaid.com Open in urlscan Pro
34.123.196.68 Public Scan

Screenshot
Live screenshot

Full Image

52
Requests

94 %
HTTPS

41 %
IPv6

17
Domains

18
Subdomains

18
IPs

4
Countries

1328 kB
Transfer

1752 kB
Size

28
Cookies

52 HTTP transactions
11 data transactions