urlscan.io logo urlscan.io
SecurityTrails logo

bnr.hyperadsdesign.com Open in urlscan Pro
35.171.199.139  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://zenoanime.onionlive.workers.dev/
Effective URL: https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&dev...
Submission: On January 19 via manual from PK — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 4 countries across 13 domains to perform 44 HTTP transactions. The main IP is 35.171.199.139, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is bnr.hyperadsdesign.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on February 23rd 2023. Valid for: a year.
This is the only time bnr.hyperadsdesign.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 3 139.45.197.234 9002 (RETN-AS)
4 139.45.195.8 9002 (RETN-AS)
1 139.45.195.253 9002 (RETN-AS)
17 188.114.96.3 13335 (CLOUDFLAR...)
1 35.171.199.139 14618 (AMAZON-AES)
1 2600:9000:223... 16509 (AMAZON-02)
4 18.197.221.185 16509 (AMAZON-02)
6 2a00:1450:400... 15169 (GOOGLE)
2 4 2606:4700:20:... 13335 (CLOUDFLAR...)
1 1 18.196.16.121 16509 (AMAZON-02)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
44 12
1    2606:4700:3034::ac43:8d6c (United States)

ASN13335 (CLOUDFLARENET, US)
zenoanime.onionlive.workers.dev
3    139.45.197.234 (United Kingdom)

ASN9002 (RETN-AS, GB)
bedrapiona.com
4    139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)
my.rtmark.net
1    139.45.195.253 (United Kingdom)

ASN9002 (RETN-AS, GB)
datatechone.com
17    188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
wholefreshstories.com
1    35.171.199.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-199-139.compute-1.amazonaws.com
bnr.hyperadsdesign.com
1    2600:9000:223d:fe00:c:cb59:380:21 (United States)

ASN16509 (AMAZON-02, US)
d38dxwbthvbuvi.cloudfront.net
4    18.197.221.185 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-221-185.eu-central-1.compute.amazonaws.com
lnk.gameclickads.net
6    2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
4    2606:4700:20::681a:dd7 (United States)

ASN13335 (CLOUDFLARENET, US)
r.linksprf.com
1    18.196.16.121 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-16-121.eu-central-1.compute.amazonaws.com
clk.tradedoubler.com
1    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
www.goboony.de
Apex Domain
Subdomains		 Transfer
17 wholefreshstories.com
wholefreshstories.com
67 KB
6 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
766 B
4 linksprf.com
r.linksprf.com — Cisco Umbrella Rank: 81816
3 KB
4 gameclickads.net
lnk.gameclickads.net
13 KB
4 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 11663
2 KB
3 bedrapiona.com
bedrapiona.com — Cisco Umbrella Rank: 209753
16 KB
1 goboony.de
www.goboony.de
1 tradedoubler.com
clk.tradedoubler.com — Cisco Umbrella Rank: 90788
540 B
1 cloudfront.net
d38dxwbthvbuvi.cloudfront.net
564 KB
1 hyperadsdesign.com
bnr.hyperadsdesign.com
2 KB
1 datatechone.com
datatechone.com — Cisco Umbrella Rank: 49226
467 B
1 workers.dev
zenoanime.onionlive.workers.dev — Cisco Umbrella Rank: 202222
1 KB
0 tradetracker.net Failed
tc.tradetracker.net Failed
44 13
Domain Requested by
17 wholefreshstories.com wholefreshstories.com
6 www.google-analytics.com lnk.gameclickads.net
4 r.linksprf.com 2 redirects lnk.gameclickads.net
4 lnk.gameclickads.net bnr.hyperadsdesign.com
lnk.gameclickads.net
4 my.rtmark.net bedrapiona.com
wholefreshstories.com
3 bedrapiona.com 1 redirects zenoanime.onionlive.workers.dev
bedrapiona.com
1 www.goboony.de r.linksprf.com
1 clk.tradedoubler.com 1 redirects
1 d38dxwbthvbuvi.cloudfront.net bnr.hyperadsdesign.com
1 bnr.hyperadsdesign.com wholefreshstories.com
1 datatechone.com bedrapiona.com
1 zenoanime.onionlive.workers.dev
0 tc.tradetracker.net Failed r.linksprf.com
44 13

This site contains no links.

Subject Issuer Validity Valid
onionlive.workers.dev
GTS CA 1P5		 2024-01-04 -
2024-04-03		 3 months crt.sh
bedrapiona.com
R3		 2024-01-11 -
2024-04-10		 3 months crt.sh
rtmark.net
R3		 2023-12-23 -
2024-03-22		 3 months crt.sh
datatechone.com
Sectigo RSA Domain Validation Secure Server CA		 2023-12-10 -
2024-12-23		 a year crt.sh
wholefreshstories.com
GTS CA 1P5		 2023-12-10 -
2024-03-09		 3 months crt.sh
*.thekingtrack.com
Amazon RSA 2048 M02		 2023-02-23 -
2024-02-12		 a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2023-10-10 -
2024-09-19		 a year crt.sh
*.gameclickads.net
Amazon RSA 2048 M01		 2023-02-13 -
2024-02-12		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
linksprf.com
GTS CA 1P5		 2024-01-02 -
2024-04-01		 3 months crt.sh
goboony.de
E1		 2023-11-24 -
2024-02-22		 3 months crt.sh

This page contains 4 frames:

Primary Page: https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&device=desktop&operatingSystem=windows&osVersion=win10&country=DE&language=de&userAgent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/120.0.6099.224%20Safari/537.36&browser=chrome&zoneId=4662728&cost=0.000015&campaignId=7848593&paid=772160355228196924&subzone_id=111194&oaid=2a14f46eec0eb6ff8934dbb57f70c112
Frame ID: 80E6390A1E2D2CA8703D18DD6EB559D9
Requests: 29 HTTP requests in this frame

Frame: https://lnk.gameclickads.net/trk/1vkj4Qw2yULtN68JYfUrpZFr?browser=chrome&browserVersion=120&campaignId=7848593&carrier=%3F&connectionType=broadband&cost=0.000015&country=DE&device=desktop&language=de&oaid=2a14f46eec0eb6ff8934dbb57f70c112&operatingSystem=windows&osVersion=win10&paid=772160355228196924&region=be&subzone_id=111194&userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F120.0.6099.224+Safari%2F537.36&zoneId=4662728&c2=true&vpw=1600&vph=1200
Frame ID: E3CDC08D5B8C85DC9089191B2DE8D539
Requests: 10 HTTP requests in this frame

Frame: https://www.goboony.de/?tduid=571563a640807d756add4ce58b951941
Frame ID: B7C0492C9C498F91DBD91D4D3C64E10F
Requests: 3 HTTP requests in this frame

Frame: https://tc.tradetracker.net/?c=34812&m=0&a=147720&r=v0304000165596743ddc86a1e4b919bca7a0c86c8b137&u=http%3A%2F%2Fwww.justfashionnow.com
Frame ID: A8E13CC59D6ADBCF3E69F17953E7EFF7
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://zenoanime.onionlive.workers.dev/ Page URL
  2. https://bedrapiona.com/4/5615727/ Page URL
  3. https://bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false HTTP 302
    https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z... Page URL
  4. https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z... Page URL
  5. https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersi... Page URL

Page Statistics

44
Requests

91 %
HTTPS

42 %
IPv6

13
Domains

13
Subdomains

12
IPs

4
Countries

665 kB
Transfer

761 kB
Size

18
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://zenoanime.onionlive.workers.dev/ Page URL
  2. https://bedrapiona.com/4/5615727/ Page URL
  3. https://bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false HTTP 302
    https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto= Page URL
  4. https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2 Page URL
  5. https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&device=desktop&operatingSystem=windows&osVersion=win10&country=DE&language=de&userAgent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/120.0.6099.224%20Safari/537.36&browser=chrome&zoneId=4662728&cost=0.000015&campaignId=7848593&paid=772160355228196924&subzone_id=111194&oaid=2a14f46eec0eb6ff8934dbb57f70c112 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false HTTP 302
  • https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Request Chain 36
  • https://r.linksprf.com/v1/redirect?type=linkId&id=53e3db5fb086406987ab2ab63f4992de&api_key=f8f9429830d1fdc6c4ec92fad304fae8&site_id=5974aa03fdcf4fb08b577a84ad12b715&dch=feed&ad_t=advertiser&yk_tag=65aa51de9969a925c65eca9a-RL-412010 HTTP 302
  • https://r.linksprf.com/v2/go?t=at4p5%3A7%2F1l2.8r7dad6u2ldrbc6m5cei9k5p1305453%26v%3Di8e5412%260p1%3Da0509020%3D6%3F5c4lb%2F7o8.8ebb4obe9a7tbk3cd%2F4sat6h&e=1&ai=9a0037f564564c68897d7108294f0c92&sct=0&ct=1705660894892&cu=4eb5768b8db246ba9778b231d745a46a&ykuid=ff6493528ee1473280caffc65b414d70&sc=1&cs=71086355b4f4ac8404053338ce5d4f1b
Request Chain 37
  • https://r.linksprf.com/v1/redirect?type=linkId&id=ee958f1e19cb49318010b711141e9e0b&api_key=f8f9429830d1fdc6c4ec92fad304fae8&site_id=5974aa03fdcf4fb08b577a84ad12b715&dch=feed&ad_t=advertiser&yk_tag=65aa51de9969a925c65eca9a-RL-410860 HTTP 302
  • https://r.linksprf.com/v2/go?t=mtcpw%3An%2Fochtaateur.cweF.%25e2%2FAc%253t8h2um701a8167c2a%26a%3Db010b0e0a685d6347d9c5611044939vcr700784c%3Db%263%3D%26%26%3D1t4p%3D3%3F%25tFn2rwkwajtsdfrs.itn%2Fos.toh&e=1&ai=d5099d43fa604a7190944ea9bbb3bfee&sct=0&ct=1705660894894&cu=6743ddc86a1e4b919bca7a0c86c8b137&ykuid=06129672e43a4de58f43d5758c27817e&sc=1&cs=e249bb133f2860566ac1d5882ded34e3
Request Chain 38
  • https://clk.tradedoubler.com/click?p=325955&a=1805214&epi=v0304000165594eb5768b8db246ba9778b231d745a46a HTTP 302
  • https://www.goboony.de/?tduid=571563a640807d756add4ce58b951941

44 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
zenoanime.onionlive.workers.dev/ 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://zenoanime.onionlive.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:8d6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
41073afd70d67192731d0e6330e0c56eef44eac903dca4baa6b319d8a87928ed

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
847e773fecbcf19a-CDG
content-encoding
br
content-type
text/html;charset=UTF-8
date
Fri, 19 Jan 2024 10:41:32 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c5JbxRwpdaIEnR2tC4jxe0cK9eWBXM34P%2FMh6GbV55hwnpuq1bPldUnozqWPvV6jsyuYHHp%2FZpS%2Bvv%2FF3e%2Boo6iulNQVMU56c42dwHjDHdGPnemhDdGhAkMJcHIDBGqvhg9M1c4HfUvWqrjebuKhcUlFLRea25wWAQ0aUrmI"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
/
bedrapiona.com/4/5615727/ 		32 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bedrapiona.com/4/5615727/
Requested by
Host: zenoanime.onionlive.workers.dev
URL: https://zenoanime.onionlive.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.234 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
3f63d12976eb31386ce4c926fa8bee5e107f5a7f61b015630cffe8f013c345cd

Request headers

Referer
https://zenoanime.onionlive.workers.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace Accept, Content-Type, Content-Length, Accept-Encoding, favicon
access-control-allow-methods
GET, POST, OPTIONS POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
* *
access-control-max-age
86400
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0 no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=utf8
date
Fri, 19 Jan 2024 10:41:32 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT Mon, 26 Jul 1997 05:00:00 GMT
link
<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
pragma
no-cache no-cache
server
nginx
timing-allow-origin
*
x-trace-id
4ddd70eba5e2d22ac7ba12f5ca4bce76
sftouch
bedrapiona.com/ 		2 B
610 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://bedrapiona.com/sftouch?userId=6fbad7e3ea684c2fbcb96a04a7c455b2&z=5615727&p_rid=e16fefa1-72f9-488c-af91-600500cb9935&p_src=sf
Requested by
Host: bedrapiona.com
URL: https://bedrapiona.com/4/5615727/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.234 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bedrapiona.com/4/5615727/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:32 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
content-length
2
x-trace-id
cc2ab91ff451ceafe6c48b333aa4aa99
pragma
no-cache
server
nginx
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain
access-control-allow-origin
https://bedrapiona.com
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
expires
Tue, 11 Jan 1994 10:00:00 GMT
img.gif
my.rtmark.net/ 		43 B
491 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://my.rtmark.net/img.gif?f=merge&userId=6fbad7e3ea684c2fbcb96a04a7c455b2&z=5615727&p_rid=e16fefa1-72f9-488c-af91-600500cb9935&p_src=sf
Requested by
Host: bedrapiona.com
URL: https://bedrapiona.com/4/5615727/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bedrapiona.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:32 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
43
add
datatechone.com/log/ 		2 B
467 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=9b5ef4ae-bb11-4b72-b08d-12bea9bf4df2
Requested by
Host: bedrapiona.com
URL: https://bedrapiona.com/4/5615727/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.253 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx/1.19.10 /
Resource Hash

Request headers

Referer
https://bedrapiona.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Fri, 19 Jan 2024 10:41:32 GMT
Server
nginx/1.19.10
Access-Control-Allow-Methods
POST, GET, OPTIONS, PUT, DELETE
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://bedrapiona.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length
2
/
wholefreshstories.com/
Redirect Chain
  • https://bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false
  • https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
40 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
44ff45ab2bba4f5bbffb365098ca83552c82d0b660686ff00db541eb7aed9344

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://bedrapiona.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods
GET, POST, OPTIONS, HEAD
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
847e77442844d0cd-AMS
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 19 Jan 2024 10:41:32 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eiSTFDFrTGZzhmikRAQVCt82Y1pthsjm6b3sP29s9M%2BjHkRVWFl2d6LGZeCLFhc%2F8Y3dyU5wzrXcOXSDFHlCkKgV9607dVmGJu5eqfCEs8hWJQmKOBLh%2B23ynB2FeaSp7bWNPX9l%2FcI%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PHP/7.4.33

Redirect headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://bedrapiona.com
access-control-max-age
86400
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
content-length
0
date
Fri, 19 Jan 2024 10:41:32 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT
link
<https://wholefreshstories.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
location
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
pragma
no-cache
referrer-policy
no-referrer
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
* *
x-content-type-options
nosniff
x-trace-id
eb1132e8bd863c6265e6a8857e23246c
gid.js
my.rtmark.net/ 		65 B
547 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/gid.js?userId=2a14f46eec0eb6ff8934dbb57f70c112
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4f316c8c4d24d7fe2b25d14256ad9bdce7fe0a1eac83e1ddfc7b190d942a8bf4
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:32 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://wholefreshstories.com
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
micro.tag.min.js
wholefreshstories.com/pfe/current/ 		26 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
73bb863239e7deafca0188b7a37efed56fec31a9f71d33cf253793c1e2738a34

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 19 Jan 2024 10:41:32 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 18 Jan 2024 08:50:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65a8e670-69d0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P98W9v8Ikup0%2BV%2BW46ap2SBXSjtB8KKpBLe5T8EPGn%2BNYPR3Bhte6MBNe4U%2FIgTHGKR3KTi2XOYKxPR1c34lYhjQ3YYHy2yN%2BDVr3fyW1RnIt%2BHTJm9XDM9EdQeTU9OrAsAxHgXA9qs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
access-control-allow-credentials
true
cf-ray
847e7744f92dd0cd-AMS
alt-svc
h3=":443"; ma=86400
truncated
/ 		327 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/svg+xml
/
wholefreshstories.com/19/4662728/ 		3 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/19/4662728/?abt_opts=1&var=5615727&var3=772160350195037043&ymid=&rhd=1
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e83e1f52e881be62e37c8bc3ac3a5fc98b8a2f5f6adad51425f184a6cf1036c
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:32 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
gzip
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-trace-id
c80217f45cb17c8949770255990163d1
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ONAkc3z8xx3tZ%2BjhW1VdyyJPraE%2Fo%2FafpsWdPZV%2BvMk4NqZ9f3Sgu%2Bv5A%2FOZbhsUWZ1PtHDyH3IqCKW5b1AeIT%2FD8nU8iTYyouJUF7XgO4qcv%2BGlNSu2t5mMTUtRkbkJw5aOGB1yMzk%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age
86400
access-control-allow-credentials
true
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin
*
link
<https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray
847e7745093ed0cd-AMS
expires
Tue, 11 Jan 1994 10:00:00 GMT
/
wholefreshstories.com/ 		2 B
415 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&mprtr=1
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:32 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yt%2BJRnzgB90Ons4hs5BtO99sWKqfePJc%2B4lNv4ltMBjgGkdSTDdSmL15TdNtssuChQRub2HZHDvUIZh8JAVztAewFiY8hCMxK0GmvXPUGC8pSbnrDCCMS8yIA2O68B7qcrnHXnvCJvk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
847e77450941d0cd-AMS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc
h3=":443"; ma=86400
4662709
wholefreshstories.com/sw-check-permissions/ 		0
857 B 		Other
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/sw-check-permissions/4662709?var=5615727&ymid=772160350195037043&uhd=1&zoneId=4662709
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YcdpJ23L2eeMxCnUTvD47mu8ee5npGjk7rHmsP1sDSfIouJ3iryfmwgvAjVzF6YZWKYWsACkPs0HUXcQ7QoAuv%2BS2z8WMAg6UAD%2BhVFGaFnI755eCXjVcd2zP6h1rdNbNRRrALTlFcU%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray
847e774569c0d0cd-AMS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc
h3=":443"; ma=86400
zone
wholefreshstories.com/ 		0
467 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=wholefreshstories.com&var=5615727&ymid=772160350195037043&var_3=&var_4=&dsig=&tg=1&sw=3.1.474&action=prerequest
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-trace-id
ed822d83332292433549f0328578e3c6
date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iL3lNzYDZPY0BFHqxm6MrtUrbOQxl51dfjatTUk0x5gtJCAY%2F6ZZj6UANuWdRNxg7BwaKgQl1Y8fjx4GK%2BxDjCG1WW%2Fc4FWsB8dYXb4jOmABm2kPPt9yFNd4zvaKlUEHPy9cQWMV9Lg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://wholefreshstories.com
access-control-allow-credentials
true
cf-ray
847e774569c1d0cd-AMS
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length
0
alt-svc
h3=":443"; ma=86400
gid.js
my.rtmark.net/ 		65 B
547 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=772160350195037043&var=5615727
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4f316c8c4d24d7fe2b25d14256ad9bdce7fe0a1eac83e1ddfc7b190d942a8bf4
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://wholefreshstories.com
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
rhd
wholefreshstories.com/ 		3 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/rhd?rb=99KaPWPlGI4NfN44XzeiMc-SknThcE3Y49cQdC59PHMdtuPdtWpJx05SBtKy_3qA8EpjjPKy-MmzjFkc3DJoL5o9H1WA0FiKevt--5XKRRe3myd1zulG_4GJZYsxGcYRPegjDT-kNtkygJY1dAvJu3W7c2tMkXl4WZ22J_DNIDKun3nkhDHghbaanCSDbjrUDO7T7HUZPWp56-G_TEIAULNdxyyE9OqVXuF7m2MJ-WZtULYrhA_0zQRZ_JEfZSMKwc1pMwBzbxI9a8nLALZRQVOWXJxm4k3FFhjiGqdnR8U8Y5PupBfCxvx5aIxvewGYb3PvKgFiNzEkp4RZ2PpFbm4V8sN46DSpf3nZkfD9eVOa7hDWmeskzr7ZKcJJRrzY75rJVoK_DpnBpgStoFBwQftxEdaUDneqcwfSCofpjJbVOVQRzYzq8d6pIE3Epk92hkItEXn1nl-oVmyT9-Viy0TrizHErwmhOqIXFKJb8Ah306FNsILt3602Hql0D6Rr4qi7tanvDIvMMvfWtDUEde0j2Y9EQwMqMFhOFg%3D%3D&request_ab2=0&zoneid=4662728&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wih=1200&wiw=1600&wfc=0&pl=https%3A%2F%2Fwholefreshstories.com%2F%3Fs%3D772160350195037043%26ssk%3D3561b55479085b2680cb95eef7c8697a%26svar%3D1705660892%26z%3D5615727%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb%26btz%3D%26bto%3D&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-unknown&var=5615727&var3=772160350195037043&ymid=&rhd=1&m=link
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
gzip
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-trace-id
0faaf6b8221d1506e44c0469a74de10f
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ynfEhkX1lpU7i5l7k1mMj7RN96wzrRpGoQzYviyQYJNnh72Mo47Q2tkonbMElmhBvcmCDkPfctK%2FanhMK7%2BYAzUs0GxyBB5it7nZVVa04Jl2N%2BB36vxrwTnye9gu9SNSnKeUSqBihik%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age
86400
access-control-allow-credentials
true
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin
*
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray
847e774579d5d0cd-AMS
expires
Tue, 11 Jan 1994 10:00:00 GMT
zone
wholefreshstories.com/ 		795 B
1023 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=wholefreshstories.com&var=5615727&ymid=772160350195037043&var_3=&var_4=&dsig=&tg=1&sw=3.1.474&action=settings
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-trace-id
f9c306720cad8e010edc1cecb94b6c83
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vw4oo9q6ghiA%2FFn3eyGxgMhWRGqsa3oEvTqu%2BE7rsOXG2QG5%2FkwftYe3hBBupOQQj5w6hMiK%2F1kN94re3vI%2BMfPiab6QpvYjgpPZypekmpltxr4hD%2FpskfBraXAMYj8a2Eb3OML2FCU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
847e77457997380a-FRA
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
/
wholefreshstories.com/ 		40 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
28386fa62202a4edbdb69c5ef9f9917c014c522a5395d36fb7f178df7b6d935c

Request headers

Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods
GET, POST, OPTIONS, HEAD
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
847e7745b9da380a-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 19 Jan 2024 10:41:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t81sgu3M2rGeDcrQgxQIw3Sb6eNgKnTLt5ZRt6YF3pcqZnKWyYABifXi3Taf3Gbi%2BbuluyrCM5bbu41GaJpxL026ikHAf0M6mfDejC4gTQ%2BLAKtwHfKDpvsEGHCRzDPY%2FXTkAM3hnWo%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PHP/7.4.33
micro.tag.min.js
wholefreshstories.com/pfe/current/ 		26 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
73bb863239e7deafca0188b7a37efed56fec31a9f71d33cf253793c1e2738a34

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 19 Jan 2024 10:41:33 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 18 Jan 2024 08:50:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65a8e670-69d0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M58NGP2VLCSkNjHZ2ue9o58KQCkweAFfORg%2BL8y5VX7YtlXEVSBX0vFkqWnlXtIVjmIli%2FY8KsOSs0a7OFKsUxmuuAaLbFM2zrE7pQGDmYjy%2FiMX08IxScJ1Tldq5j1t%2FP%2F3vZOJvpA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
access-control-allow-credentials
true
cf-ray
847e77466aa8380a-FRA
alt-svc
h3=":443"; ma=86400
truncated
/ 		327 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/svg+xml
/
wholefreshstories.com/19/4662728/ 		3 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/19/4662728/?abt_opts=1&var=5615727&var3=772160350195037043&ymid=&rhd=1
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0310767183d60f5f8ca30b0c1c1e9f5fe13e9601d6557216c528306f6f3b7e9
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
gzip
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-trace-id
afb962305c140529a88343cf7d2e02b1
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b%2BGXlw6rXEYiXcquiOIvtTpohRqEvhHrTtr40pQAGLhlQeTFKdidHDl%2FbqfvYW9izUJ4MSWLiFd5Ycn3u7uQSqBVNcZ32xBDJZj2geMcQR%2Bo7N0wfcOngXWrbjbUcsY5hJzasyM28%2FY%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age
86400
access-control-allow-credentials
true
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin
*
link
<https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray
847e77467aac380a-FRA
expires
Tue, 11 Jan 1994 10:00:00 GMT
/
wholefreshstories.com/ 		2 B
530 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2&mprtr=1
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=InbsN4xjr3OTN1E9EbKkEuzLphEtjKsVqE5498cYVHC9xiVPie2AbPPyq45JwF5QLsGff4gajBGaRl1hq5XeEGPcHMJfTw547splQQ6waLpGtCnaGY5SB%2BsWSlrasArZZVUv0E7AQVY%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
847e77469ac9380a-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc
h3=":443"; ma=86400
rhd
wholefreshstories.com/ 		4 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/rhd?rb=HlRJZnLPCOaeFRSZujUFX_2QYQaI2hFY6DxBpD6nudPlPkHpL2chebtn0v37liibI9AxFEUbRYysGjoimCRWLpD6ibFZY-1k2qXpWg6hkn19NuI831g66bjNGvFR6enxg5Klzyxngu5y6Vxn2I41lEvR6ZIaulAunMCCXlOzfFc3A0EK2UnXwu-E-XIhS8a_mFOTMrN0qgUIuRyYxcVc23fC9WNH91b7Gv4OT2YDNVevgjjCenzlgBOjWgC3S8zWjiFec9C3u2Iekuws2ol9BjPwZVNIsABnuXfcf-jfwRDrQNPeTM9f3ncWGggsHtlv3yRM0YnOapnqaKgIch3m1gMljmXPT9vrBOW8iExuqBMQ7NwuCKdPWmBEXn7GlQA6BoIV919N8bq-2aY-XrYcVBzPl5QY_HH1fT7imWZvlZyTkh88GTSjwhtuDdfVLVnYoJuO_iflJtrjZENk1rc97uPYuggYITzdAWYm7yPGKRofMeN-VnRb2J1tm4YUruTquG8GDfESy_-c7oDlyaOrAYw4XylZrTe6xATdRlHYLV0%3D&request_ab2=0&zoneid=4662728&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wih=1200&wiw=1600&wfc=0&pl=https%3A%2F%2Fwholefreshstories.com%2F%3Fs%3D772160350195037043%26ssk%3D3561b55479085b2680cb95eef7c8697a%26svar%3D1705660892%26z%3D5615727%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb%26btz%3D%26bto%3D%26rdc%3D2&drf=https%3A%2F%2Fwholefreshstories.com%2F%3Fs%3D772160350195037043%26ssk%3D3561b55479085b2680cb95eef7c8697a%26svar%3D1705660892%26z%3D5615727%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb%26btz%3D%26bto%3D&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-unknown&var=5615727&var3=772160350195037043&ymid=&rhd=1&m=link
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5ae9c209c8eeb635a6e25ace70b0b786fcdd97220fcbf806c64e0b5efe69bbf0
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
gzip
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-trace-id
da27eda462eb4753b2eb9c90e6e305c3
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F%2BE30f6ySjdHaG84fDh7NqXlhYQeGeZWWJZ0Qw8D1PRwYNtkdqPcbk4yGg0MlJkRCdFGxUw%2BIha6E7p3xWmD2qs%2FwFYezkzKW81bM0Z6qwIgYcBKuwuWpEGHg%2FVhNm1VbnrvghYjirs%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age
86400
access-control-allow-credentials
true
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin
*
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray
847e7746db20380a-FRA
expires
Tue, 11 Jan 1994 10:00:00 GMT
4662709
wholefreshstories.com/sw-check-permissions/ 		0
956 B 		Other
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/sw-check-permissions/4662709?var=5615727&ymid=772160350195037043&uhd=1&zoneId=4662709
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q53RZ4npjqRZ1OC52SkmTP0SY%2BXzh4bwJOKb%2B9AUAdl6AzLfdpzw7Ae9JJYdirHYrBp2vi4tRzzWFoAggLY5R82lDFUhbJNaqh9mUgxO4173kCjB6e7YNNAIreLHP3aPNHbuWMRuh2g%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray
847e7746eb28380a-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc
h3=":443"; ma=86400
zone
wholefreshstories.com/ 		0
500 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=wholefreshstories.com&var=5615727&ymid=772160350195037043&var_3=&var_4=&dsig=&tg=1&sw=3.1.474&action=prerequest
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-trace-id
f648bf43d82a084842466fb044a50bbc
date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bsMyWc4GWObRqsv1qVZVuWQdLn4nVO%2B6d49D4%2B3qdB4XKIss5GhXYJ29ExKawhf1dVZsJ9tw%2BN2g63RYypur7BUkno%2B0eqpKFQwSd%2F7IboZh4NWC6KsdOoIN908dCkIwLpskAd9p6i8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://wholefreshstories.com
access-control-allow-credentials
true
cf-ray
847e7746eb2a380a-FRA
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length
0
alt-svc
h3=":443"; ma=86400
gid.js
my.rtmark.net/ 		65 B
547 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=772160350195037043&var=5615727
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4f316c8c4d24d7fe2b25d14256ad9bdce7fe0a1eac83e1ddfc7b190d942a8bf4
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://wholefreshstories.com
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
zone
wholefreshstories.com/ 		795 B
991 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=wholefreshstories.com&var=5615727&ymid=772160350195037043&var_3=&var_4=&dsig=&tg=1&sw=3.1.474&action=settings
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/pfe/current/micro.tag.min.js?z=4662709&ymid=772160350195037043&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7946242972b39bead0390fe88b1673d58bf7d31641e4ae34132aff341335156c
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-trace-id
c754e7787978587614a3a88c9c1a593d
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KQazXoHDglLZIgvCLYpxqer5xifIHHuHYbZ4%2FZ7PQB9juVJZOoVYn1Cr8x8%2BNabyj8GDaqNtcUCNxvghSGAHcV3JTeOlm5TGB%2FEEJMQuyCCEPnckRr9Z%2FodgW%2BJv7UpqxJ%2Fw2jwj0z0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
847e7746fb3a380a-FRA
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
Primary Request 1vkj4Qw2yULtN68JYfUrpZFr
bnr.hyperadsdesign.com/get/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&device=desktop&operatingSystem=windows&osVersion=win10&country=DE&language=de&userAgent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/120.0.6099.224%20Safari/537.36&browser=chrome&zoneId=4662728&cost=0.000015&campaignId=7848593&paid=772160355228196924&subzone_id=111194&oaid=2a14f46eec0eb6ff8934dbb57f70c112
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.171.199.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-171-199-139.compute-1.amazonaws.com
Software
awselb/2.0 /
Resource Hash
7477ac78ac73b6aa09eae50de3045d56875f911e3ba933149b15a82016c6935f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
1685
content-type
text/html
date
Fri, 19 Jan 2024 10:41:34 GMT
server
awselb/2.0
cat.php
wholefreshstories.com/ 		0
763 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://wholefreshstories.com/cat.php?userId=2a14f46eec0eb6ff8934dbb57f70c112&zoneid=4662728&rb=HlRJZnLPCOaeFRSZujUFX_2QYQaI2hFY6DxBpD6nudPlPkHpL2chebtn0v37liibI9AxFEUbRYysGjoimCRWLpD6ibFZY-1k2qXpWg6hkn19NuI831g66bjNGvFR6enxg5Klzyxngu5y6Vxn2I41lEvR6ZIaulAunMCCXlOzfFc3A0EK2UnXwu-E-XIhS8a_mFOTMrN0qgUIuRyYxcVc23fC9WNH91b7Gv4OT2YDNVevgjjCenzlgBOjWgC3S8zWjiFec9C3u2Iekuws2ol9BjPwZVNIsABnuXfcf-jfwRDrQNPeTM9f3ncWGggsHtlv3yRM0YnOapnqaKgIch3m1gMljmXPT9vrBOW8iExuqBMQ7NwuCKdPWmBEXn7GlQA6BoIV919N8bq-2aY-XrYcVBzPl5QY_HH1fT7imWZvlZyTkh88GTSjwhtuDdfVLVnYoJuO_iflJtrjZENk1rc97uPYuggYITzdAWYm7yPGKRofMeN-VnRb2J1tm4YUruTquG8GDfESy_-c7oDlyaOrAYw4XylZrTe6xATdRlHYLV0=&var=5615727&var3=772160350195037043&ymid=&rhd=1
Requested by
Host: wholefreshstories.com
URL: https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://wholefreshstories.com/?s=772160350195037043&ssk=3561b55479085b2680cb95eef7c8697a&svar=1705660892&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=&bto=&rdc=2
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 19 Jan 2024 10:41:33 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
0
x-trace-id
06d3e92fc51a27377a37d2f02b276c76
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server
cloudflare
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2wz%2BLp8Omi1SSSdpztqGma03jXfUgXNV6yd3FR9UMoOpRE8BgIF79usDClEaaTT7tZgbw3DByacRKiIUPHo1NQlSOnDYitKstzADhgAEAYxSgCQOMtRIPwM9NTjbdpkgR%2FPGF9zV71o%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://wholefreshstories.com
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray
847e774a5eb5380a-FRA
expires
Tue, 11 Jan 1994 10:00:00 GMT
d4014e4019717fd3490b2e0f215fc738.png
d38dxwbthvbuvi.cloudfront.net/jcm-mm/ 		563 KB
564 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d38dxwbthvbuvi.cloudfront.net/jcm-mm/d4014e4019717fd3490b2e0f215fc738.png
Requested by
Host: bnr.hyperadsdesign.com
URL: https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&device=desktop&operatingSystem=windows&osVersion=win10&country=DE&language=de&userAgent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/120.0.6099.224%20Safari/537.36&browser=chrome&zoneId=4662728&cost=0.000015&campaignId=7848593&paid=772160355228196924&subzone_id=111194&oaid=2a14f46eec0eb6ff8934dbb57f70c112
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:fe00:c:cb59:380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b968694c2bb18e5ab881d4e65c0881e8978c9444911c91dd6e2cfdc9e2707ad3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&device=desktop&operatingSystem=windows&osVersion=win10&country=DE&language=de&userAgent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/120.0.6099.224%20Safari/537.36&browser=chrome&zoneId=4662728&cost=0.000015&campaignId=7848593&paid=772160355228196924&subzone_id=111194&oaid=2a14f46eec0eb6ff8934dbb57f70c112
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 05:13:25 GMT
via
1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
last-modified
Thu, 18 May 2023 19:58:13 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P3
age
19690
x-amz-server-side-encryption
AES256
etag
"e8e95bcac1e9ed550df5b767e6434e14"
vary
Accept-Encoding
x-cache
Hit from cloudfront
accept-ranges
bytes
content-length
576549
x-amz-cf-id
2tFH6ctoL0VTDHONOBzK9hTZHLJ31lL7xHtICMTgQbHPJT6Mb4a9rw==
1vkj4Qw2yULtN68JYfUrpZFr
lnk.gameclickads.net/trk/ Frame E3CD 		3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://lnk.gameclickads.net/trk/1vkj4Qw2yULtN68JYfUrpZFr?browser=chrome&browserVersion=120&campaignId=7848593&carrier=%3F&connectionType=broadband&cost=0.000015&country=DE&device=desktop&language=de&oaid=2a14f46eec0eb6ff8934dbb57f70c112&operatingSystem=windows&osVersion=win10&paid=772160355228196924&region=be&subzone_id=111194&userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F120.0.6099.224+Safari%2F537.36&zoneId=4662728&c2=true&vpw=1600&vph=1200
Requested by
Host: bnr.hyperadsdesign.com
URL: https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&device=desktop&operatingSystem=windows&osVersion=win10&country=DE&language=de&userAgent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/120.0.6099.224%20Safari/537.36&browser=chrome&zoneId=4662728&cost=0.000015&campaignId=7848593&paid=772160355228196924&subzone_id=111194&oaid=2a14f46eec0eb6ff8934dbb57f70c112
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.221.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-221-185.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
9abacf1a41dd7738c0834d9d86bea8f1e1b11f8baf25a698c55582ba4f12320b

Request headers

Referer
https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&device=desktop&operatingSystem=windows&osVersion=win10&country=DE&language=de&userAgent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/120.0.6099.224%20Safari/537.36&browser=chrome&zoneId=4662728&cost=0.000015&campaignId=7848593&paid=772160355228196924&subzone_id=111194&oaid=2a14f46eec0eb6ff8934dbb57f70c112
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-language
de-DE
content-type
text/html;charset=UTF-8
date
Fri, 19 Jan 2024 10:41:34 GMT
c.js
lnk.gameclickads.net/js/ Frame E3CD 		8 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lnk.gameclickads.net/js/c.js
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/trk/1vkj4Qw2yULtN68JYfUrpZFr?browser=chrome&browserVersion=120&campaignId=7848593&carrier=%3F&connectionType=broadband&cost=0.000015&country=DE&device=desktop&language=de&oaid=2a14f46eec0eb6ff8934dbb57f70c112&operatingSystem=windows&osVersion=win10&paid=772160355228196924&region=be&subzone_id=111194&userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F120.0.6099.224+Safari%2F537.36&zoneId=4662728&c2=true&vpw=1600&vph=1200
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.221.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-221-185.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e762d6ca1ddd7dab2fa0db7702efdbd3bc10e6f7f3be7b0f8818d45d5bcb96d7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lnk.gameclickads.net/trk/1vkj4Qw2yULtN68JYfUrpZFr?browser=chrome&browserVersion=120&campaignId=7848593&carrier=%3F&connectionType=broadband&cost=0.000015&country=DE&device=desktop&language=de&oaid=2a14f46eec0eb6ff8934dbb57f70c112&operatingSystem=windows&osVersion=win10&paid=772160355228196924&region=be&subzone_id=111194&userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F120.0.6099.224+Safari%2F537.36&zoneId=4662728&c2=true&vpw=1600&vph=1200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Fri, 19 Jan 2024 10:41:34 GMT
last-modified
Thu, 02 Mar 2023 20:32:50 GMT
accept-ranges
bytes
content-length
7804
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript
/
lnk.gameclickads.net/ Frame B7C0 		835 B
946 B 		Document
General
Check archive.org
Download Go to
Full URL
https://lnk.gameclickads.net/?bt=kt.st00rmds.com&ref=&friend=&u=r.linksprf.com%252Fv1%252Fredirect%253Ftype%253DlinkId%2526id%253D53e3db5fb086406987ab2ab63f4992de%2526api_key%253Df8f9429830d1fdc6c4ec92fad304fae8%2526site_id%253D5974aa03fdcf4fb08b577a84ad12b715%2526dch%253Dfeed%2526ad_t%253Dadvertiser%2526yk_tag%253D65aa51de9969a925c65eca9a-RL-412010&log=false&type=ROTATOR_LINK&linkId=412010&clickId=65aa51de9969a925c65eca9a&br=true
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/js/c.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.221.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-221-185.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e062b3bee6b009a75a224fcd19209cd54676be993cfdbf26e4ac9e3d71b3ea06

Request headers

Referer
https://lnk.gameclickads.net/trk/1vkj4Qw2yULtN68JYfUrpZFr?browser=chrome&browserVersion=120&campaignId=7848593&carrier=%3F&connectionType=broadband&cost=0.000015&country=DE&device=desktop&language=de&oaid=2a14f46eec0eb6ff8934dbb57f70c112&operatingSystem=windows&osVersion=win10&paid=772160355228196924&region=be&subzone_id=111194&userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F120.0.6099.224+Safari%2F537.36&zoneId=4662728&c2=true&vpw=1600&vph=1200
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-language
de-DE
content-type
text/html;charset=UTF-8
date
Fri, 19 Jan 2024 10:41:34 GMT
referrer-policy
no-referrer
/
lnk.gameclickads.net/ Frame A8E1 		835 B
946 B 		Document
General
Check archive.org
Download Go to
Full URL
https://lnk.gameclickads.net/?bt=kt.st00rmds.com&ref=&friend=&u=r.linksprf.com%252Fv1%252Fredirect%253Ftype%253DlinkId%2526id%253Dee958f1e19cb49318010b711141e9e0b%2526api_key%253Df8f9429830d1fdc6c4ec92fad304fae8%2526site_id%253D5974aa03fdcf4fb08b577a84ad12b715%2526dch%253Dfeed%2526ad_t%253Dadvertiser%2526yk_tag%253D65aa51de9969a925c65eca9a-RL-410860&log=false&type=ROTATOR_LINK&linkId=410860&clickId=65aa51de9969a925c65eca9a&br=true
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/js/c.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.221.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-221-185.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
068672e2dac1a3b8eda31f1259c36d47e47e68959ca195e8d326aacaa06cc4e0

Request headers

Referer
https://lnk.gameclickads.net/trk/1vkj4Qw2yULtN68JYfUrpZFr?browser=chrome&browserVersion=120&campaignId=7848593&carrier=%3F&connectionType=broadband&cost=0.000015&country=DE&device=desktop&language=de&oaid=2a14f46eec0eb6ff8934dbb57f70c112&operatingSystem=windows&osVersion=win10&paid=772160355228196924&region=be&subzone_id=111194&userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F120.0.6099.224+Safari%2F537.36&zoneId=4662728&c2=true&vpw=1600&vph=1200
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-language
de-DE
content-type
text/html;charset=UTF-8
date
Fri, 19 Jan 2024 10:41:34 GMT
referrer-policy
no-referrer
collect
www.google-analytics.com/ Frame E3CD 		35 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect?v=1&tid=UA-61165759-1&t=pageview&ds=web&aip=1&cs=referral&cm=4284&cn=%28not+set%29&cc=%28not+set%29&dh=www.goboony.de&dp=%2F&dt=Wohnmobil+direkt+vom+Eigent%C3%BCmer+mieten+%E2%80%93+Goboony+Wohnmobilvermietung&dr=&vp=1600x1200&sr=1600x1200&je=0&ul=en-US&cid=1330755446.193613024
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/js/c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lnk.gameclickads.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jan 2024 23:33:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
40067
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ Frame E3CD 		35 B
301 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect?cs=The+Ad+Storm&cc=412010&ck=42225&cm=YieldKit&cn=Goboony&tid=UA-207047394-1&v=1&t=pageview&ds=web&aip=1&dh=www.goboony.de&dp=%2F&dt=Wohnmobil+direkt+vom+Eigent%C3%BCmer+mieten+%E2%80%93+Goboony+Wohnmobilvermietung&dr=&vp=1600x1200&sr=1600x1200&je=0&ul=en-US&cid=1191188413.1272248868
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/js/c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lnk.gameclickads.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jan 2024 23:33:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
40067
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ Frame E3CD 		35 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect?v=1&tid=UA-90038792-1&t=pageview&ds=web&aip=1&cs=Affiliate&cm=webgains&cn=JFNDE1552905&cc=299320_1552905_17004896835819_2596268335&dh=de.justfashionnow.com&dp=%2F&dt=JustFashionNow+%7C+online+kaufen+f%C3%BCr+erschwingliche+kleider+f%C3%BCr+frauen+k+%7C+de.justfashionnow&dr=&vp=1600x1200&sr=1600x1200&je=0&ul=en-US&cid=1479646386.1195146386
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/js/c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lnk.gameclickads.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jan 2024 23:33:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
40067
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ Frame E3CD 		35 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect?cs=The+Ad+Storm&cc=410860&ck=42225&cm=YieldKit&cn=Just+Fashion+Now&tid=UA-207047394-1&v=1&t=pageview&ds=web&aip=1&dh=de.justfashionnow.com&dp=%2F&dt=JustFashionNow+%7C+online+kaufen+f%C3%BCr+erschwingliche+kleider+f%C3%BCr+frauen+k+%7C+de.justfashionnow&dr=&vp=1600x1200&sr=1600x1200&je=0&ul=en-US&cid=123718334.1402454438
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/js/c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lnk.gameclickads.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jan 2024 23:33:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
40067
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
go
r.linksprf.com/v2/ Frame B7C0
Redirect Chain
  • https://r.linksprf.com/v1/redirect?type=linkId&id=53e3db5fb086406987ab2ab63f4992de&api_key=f8f9429830d1fdc6c4ec92fad304fae8&site_id=5974aa03fdcf4fb08b577a84ad12b715&dch=feed&ad_t=advertiser&yk_tag=...
  • https://r.linksprf.com/v2/go?t=at4p5%3A7%2F1l2.8r7dad6u2ldrbc6m5cei9k5p1305453%26v%3Di8e5412%260p1%3Da0509020%3D6%3F5c4lb%2F7o8.8ebb4obe9a7tbk3cd%2F4sat6h&e=1&ai=9a0037f564564c68897d7108294f0c92&sc...
1 KB
802 B 		Document
General
Check archive.org
Download Go to
Full URL
https://r.linksprf.com/v2/go?t=at4p5%3A7%2F1l2.8r7dad6u2ldrbc6m5cei9k5p1305453%26v%3Di8e5412%260p1%3Da0509020%3D6%3F5c4lb%2F7o8.8ebb4obe9a7tbk3cd%2F4sat6h&e=1&ai=9a0037f564564c68897d7108294f0c92&sct=0&ct=1705660894892&cu=4eb5768b8db246ba9778b231d745a46a&ykuid=ff6493528ee1473280caffc65b414d70&sc=1&cs=71086355b4f4ac8404053338ce5d4f1b
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/?bt=kt.st00rmds.com&ref=&friend=&u=r.linksprf.com%252Fv1%252Fredirect%253Ftype%253DlinkId%2526id%253D53e3db5fb086406987ab2ab63f4992de%2526api_key%253Df8f9429830d1fdc6c4ec92fad304fae8%2526site_id%253D5974aa03fdcf4fb08b577a84ad12b715%2526dch%253Dfeed%2526ad_t%253Dadvertiser%2526yk_tag%253D65aa51de9969a925c65eca9a-RL-412010&log=false&type=ROTATOR_LINK&linkId=412010&clickId=65aa51de9969a925c65eca9a&br=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:dd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d00b15540694cec208556abcc6dffa35a3332f428d420fc13cf073addb957fdc

Request headers

Referer
https://lnk.gameclickads.net/?bt=kt.st00rmds.com&ref=&friend=&u=r.linksprf.com%252Fv1%252Fredirect%253Ftype%253DlinkId%2526id%253D53e3db5fb086406987ab2ab63f4992de%2526api_key%253Df8f9429830d1fdc6c4ec92fad304fae8%2526site_id%253D5974aa03fdcf4fb08b577a84ad12b715%2526dch%253Dfeed%2526ad_t%253Dadvertiser%2526yk_tag%253D65aa51de9969a925c65eca9a-RL-412010&log=false&type=ROTATOR_LINK&linkId=412010&clickId=65aa51de9969a925c65eca9a&br=true
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cf-cache-status
DYNAMIC
cf-ray
847e77516a726adf-FRA
content-encoding
br
content-type
text/html;charset=UTF-8
date
Fri, 19 Jan 2024 10:41:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iQTHQbTZ6eCFktr%2B9n4cDS3L8Hih%2FBtaj3tdcL%2FAF2rrXoPb0di4tKCoXBOJHNW4sGQrhTOTVzAAd2VlS1LPhffevlzo2INHvOCpiDW1rnO4bsF9lbSrD6iurRdGvvJ9Z8BJ6Ea%2F4PlaYaUT"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

cf-cache-status
DYNAMIC
cf-ray
847e7750c9926adf-FRA
content-length
0
date
Fri, 19 Jan 2024 10:41:34 GMT
location
/v2/go?t=at4p5%3A7%2F1l2.8r7dad6u2ldrbc6m5cei9k5p1305453%26v%3Di8e5412%260p1%3Da0509020%3D6%3F5c4lb%2F7o8.8ebb4obe9a7tbk3cd%2F4sat6h&e=1&ai=9a0037f564564c68897d7108294f0c92&sct=0&ct=1705660894892&cu=4eb5768b8db246ba9778b231d745a46a&ykuid=ff6493528ee1473280caffc65b414d70&sc=1&cs=71086355b4f4ac8404053338ce5d4f1b
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p
CP="CAO PSA OUR"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P2BKTomHqZ9UTOGQLl8s%2FEe18M8GJLW1H88W9w4vFqAhqfxAZSvA8Gg2dmlo43dUgDgAtCa2UJuKPElThFu6SDVhYlO45vlDenCLoAVMYty5Fxb2QE7TmLyf5eWASMOoqaUk2Ozz7aP36UiL"}],"group":"cf-nel","max_age":604800}
server
cloudflare
go
r.linksprf.com/v2/ Frame A8E1
Redirect Chain
  • https://r.linksprf.com/v1/redirect?type=linkId&id=ee958f1e19cb49318010b711141e9e0b&api_key=f8f9429830d1fdc6c4ec92fad304fae8&site_id=5974aa03fdcf4fb08b577a84ad12b715&dch=feed&ad_t=advertiser&yk_tag=...
  • https://r.linksprf.com/v2/go?t=mtcpw%3An%2Fochtaateur.cweF.%25e2%2FAc%253t8h2um701a8167c2a%26a%3Db010b0e0a685d6347d9c5611044939vcr700784c%3Db%263%3D%26%26%3D1t4p%3D3%3F%25tFn2rwkwajtsdfrs.itn%2Fos....
1 KB
811 B 		Document
General
Check archive.org
Download Go to
Full URL
https://r.linksprf.com/v2/go?t=mtcpw%3An%2Fochtaateur.cweF.%25e2%2FAc%253t8h2um701a8167c2a%26a%3Db010b0e0a685d6347d9c5611044939vcr700784c%3Db%263%3D%26%26%3D1t4p%3D3%3F%25tFn2rwkwajtsdfrs.itn%2Fos.toh&e=1&ai=d5099d43fa604a7190944ea9bbb3bfee&sct=0&ct=1705660894894&cu=6743ddc86a1e4b919bca7a0c86c8b137&ykuid=06129672e43a4de58f43d5758c27817e&sc=1&cs=e249bb133f2860566ac1d5882ded34e3
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/?bt=kt.st00rmds.com&ref=&friend=&u=r.linksprf.com%252Fv1%252Fredirect%253Ftype%253DlinkId%2526id%253Dee958f1e19cb49318010b711141e9e0b%2526api_key%253Df8f9429830d1fdc6c4ec92fad304fae8%2526site_id%253D5974aa03fdcf4fb08b577a84ad12b715%2526dch%253Dfeed%2526ad_t%253Dadvertiser%2526yk_tag%253D65aa51de9969a925c65eca9a-RL-410860&log=false&type=ROTATOR_LINK&linkId=410860&clickId=65aa51de9969a925c65eca9a&br=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:dd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4355d0e413c8cb3d1065019dad2460714f9cb592726dec495b414da91d22b05

Request headers

Referer
https://lnk.gameclickads.net/?bt=kt.st00rmds.com&ref=&friend=&u=r.linksprf.com%252Fv1%252Fredirect%253Ftype%253DlinkId%2526id%253Dee958f1e19cb49318010b711141e9e0b%2526api_key%253Df8f9429830d1fdc6c4ec92fad304fae8%2526site_id%253D5974aa03fdcf4fb08b577a84ad12b715%2526dch%253Dfeed%2526ad_t%253Dadvertiser%2526yk_tag%253D65aa51de9969a925c65eca9a-RL-410860&log=false&type=ROTATOR_LINK&linkId=410860&clickId=65aa51de9969a925c65eca9a&br=true
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cf-cache-status
DYNAMIC
cf-ray
847e77516a766adf-FRA
content-encoding
br
content-type
text/html;charset=UTF-8
date
Fri, 19 Jan 2024 10:41:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lJihnkz4HD3rj794jngaQXQzh5KPdrQU6dN5jJsw%2B%2BIqkk97Qs2gRzvMNUCIZC6l3t5SDgyK5I5aT26h6yw6OVHdwCMON6Nbqtdpl%2BCm0sCqI63RfEFeqiTD2ArRLAMozAy%2BSpQjxMVdxZdO"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

cf-cache-status
DYNAMIC
cf-ray
847e7750c9906adf-FRA
content-length
0
date
Fri, 19 Jan 2024 10:41:34 GMT
location
/v2/go?t=mtcpw%3An%2Fochtaateur.cweF.%25e2%2FAc%253t8h2um701a8167c2a%26a%3Db010b0e0a685d6347d9c5611044939vcr700784c%3Db%263%3D%26%26%3D1t4p%3D3%3F%25tFn2rwkwajtsdfrs.itn%2Fos.toh&e=1&ai=d5099d43fa604a7190944ea9bbb3bfee&sct=0&ct=1705660894894&cu=6743ddc86a1e4b919bca7a0c86c8b137&ykuid=06129672e43a4de58f43d5758c27817e&sc=1&cs=e249bb133f2860566ac1d5882ded34e3
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p
CP="CAO PSA OUR"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sBoC6dbvYvh8w0COuxKOpnSfWUFeeqAWWrnJNr79AO%2Bkg%2BGxpNLwIbFISTESIRDxF%2Fa7Pk2nzhQHMA7%2FvIXCVim9IntGSwB45D3A1qJFjG6x9O%2Bm69pXuJ3bZ%2FPESJgvi6drfaxZCpX09cCh"}],"group":"cf-nel","max_age":604800}
server
cloudflare
/
www.goboony.de/ Frame B7C0
Redirect Chain
  • https://clk.tradedoubler.com/click?p=325955&a=1805214&epi=v0304000165594eb5768b8db246ba9778b231d745a46a
  • https://www.goboony.de/?tduid=571563a640807d756add4ce58b951941
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.goboony.de/?tduid=571563a640807d756add4ce58b951941
Requested by
Host: r.linksprf.com
URL: https://r.linksprf.com/v2/go?t=at4p5%3A7%2F1l2.8r7dad6u2ldrbc6m5cei9k5p1305453%26v%3Di8e5412%260p1%3Da0509020%3D6%3F5c4lb%2F7o8.8ebb4obe9a7tbk3cd%2F4sat6h&e=1&ai=9a0037f564564c68897d7108294f0c92&sct=0&ct=1705660894892&cu=4eb5768b8db246ba9778b231d745a46a&ykuid=ff6493528ee1473280caffc65b414d70&sc=1&cs=71086355b4f4ac8404053338ce5d4f1b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://r.linksprf.com/v2/go?t=at4p5%3A7%2F1l2.8r7dad6u2ldrbc6m5cei9k5p1305453%26v%3Di8e5412%260p1%3Da0509020%3D6%3F5c4lb%2F7o8.8ebb4obe9a7tbk3cd%2F4sat6h&e=1&ai=9a0037f564564c68897d7108294f0c92&sct=0&ct=1705660894892&cu=4eb5768b8db246ba9778b231d745a46a&ykuid=ff6493528ee1473280caffc65b414d70&sc=1&cs=71086355b4f4ac8404053338ce5d4f1b
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=0, private, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
847e7754bfe53c95-CDG
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 19 Jan 2024 10:41:35 GMT
link
</assets/tailwind-b96e7963ff5d2c7142d344b94306ed79ec487bafd40262c89498e6ce214266d9.css>; rel=preload; as=style; nopush,</assets/inter-font-4ddcf38821ccef2c927f268d89d140043f170368fae392cc628874b2dafe1f85.css>; rel=preload; as=style; nopush,</assets/showroom-4c8887cf2fe5926265ce25fda7aef533bbb5ff5d01c025b2f89aaa87697c849f.css>; rel=preload; as=style; nopush,</packs/css/375-35cd57b8.css>; rel=preload; as=style; nopush,</packs/css/514-2e1b795c.css>; rel=preload; as=style; nopush,</packs/css/application-e3a478a6.css>; rel=preload; as=style; nopush,</packs/css/showroom-2e70f950.css>; rel=preload; as=style; nopush,</assets/showroom-45c9326f392a714ac43e3cd3b3e5152952f16a70ec01f6c150cab18b7feb3ab8.js>; rel=preload; as=script; nopush
nel
{"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
referrer-policy
strict-origin-when-cross-origin
report-to
{"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1705660895&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=EVFjLduI11jc%2BKMbjZ1Q%2FnMCwSL9qS7yCYNt3AHNWWY%3D"}]}
reporting-endpoints
heroku-nel=https://nel.heroku.com/reports?ts=1705660895&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=EVFjLduI11jc%2BKMbjZ1Q%2FnMCwSL9qS7yCYNt3AHNWWY%3D
server
cloudflare
strict-transport-security
max-age=63072000; includeSubDomains
vary
Accept-Encoding
via
1.1 vegur
x-content-type-options
nosniff
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-request-id
fa1ef132-d850-4b6a-8981-0c4ffc097044
x-runtime
0.064851
x-xss-protection
0

Redirect headers

access-control-allow-origin
*
cache-control
private, max-age=0
content-length
266
content-type
text/html; charset=ISO-8859-1
date
Fri, 19 Jan 2024 10:41:35 GMT
location
https://www.goboony.de?tduid=571563a640807d756add4ce58b951941
pragma
no-cache
referrer-policy
origin
server
TXServerHttp
/
tc.tradetracker.net/ Frame A8E1 		0
0
/
tc.tradetracker.net/ Frame A8E1 		0
0
collect
www.google-analytics.com/ Frame E3CD 		35 B
97 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect?v=1&tid=UA-90038792-1&t=pageview&ds=web&aip=1&cs=Affiliate&cm=webgains&cn=JFNDE1552905&cc=299320_1552905_17004896835819_2596268335&dh=de.justfashionnow.com&dp=%2F&dt=JustFashionNow+%7C+online+kaufen+f%C3%BCr+erschwingliche+kleider+f%C3%BCr+frauen+k+%7C+de.justfashionnow&dr=&vp=1600x1200&sr=1600x1200&je=0&ul=en-US&cid=1479646386.1195146386
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/js/c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lnk.gameclickads.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jan 2024 23:33:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
40070
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ Frame E3CD 		35 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect?cs=The+Ad+Storm&cc=410860&ck=42225&cm=YieldKit&cn=Just+Fashion+Now&tid=UA-207047394-1&v=1&t=pageview&ds=web&aip=1&dh=de.justfashionnow.com&dp=%2F&dt=JustFashionNow+%7C+online+kaufen+f%C3%BCr+erschwingliche+kleider+f%C3%BCr+frauen+k+%7C+de.justfashionnow&dr=&vp=1600x1200&sr=1600x1200&je=0&ul=en-US&cid=123718334.1402454438
Requested by
Host: lnk.gameclickads.net
URL: https://lnk.gameclickads.net/js/c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lnk.gameclickads.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jan 2024 23:33:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
40070
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ Frame E3CD 		0
0
collect
www.google-analytics.com/ Frame E3CD 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
tc.tradetracker.net
URL
https://tc.tradetracker.net/?c=34812&m=0&a=147720&r=v0304000165596743ddc86a1e4b919bca7a0c86c8b137&u=http%3A%2F%2Fwww.justfashionnow.com
Domain
tc.tradetracker.net
URL
https://tc.tradetracker.net/?c=34812&m=0&a=147720&r=v0304000165596743ddc86a1e4b919bca7a0c86c8b137&u=http%3A%2F%2Fwww.justfashionnow.com
Domain
www.google-analytics.com
URL
https://www.google-analytics.com/collect?v=1&tid=UA-61165759-1&t=pageview&ds=web&aip=1&cs=referral&cm=4284&cn=%28not+set%29&cc=%28not+set%29&dh=www.goboony.de&dp=%2F&dt=Wohnmobil+direkt+vom+Eigent%C3%BCmer+mieten+%E2%80%93+Goboony+Wohnmobilvermietung&dr=&vp=1600x1200&sr=1600x1200&je=0&ul=en-US&cid=1330755446.193613024
Domain
www.google-analytics.com
URL
https://www.google-analytics.com/collect?cs=The+Ad+Storm&cc=412010&ck=42225&cm=YieldKit&cn=Goboony&tid=UA-207047394-1&v=1&t=pageview&ds=web&aip=1&dh=www.goboony.de&dp=%2F&dt=Wohnmobil+direkt+vom+Eigent%C3%BCmer+mieten+%E2%80%93+Goboony+Wohnmobilvermietung&dr=&vp=1600x1200&sr=1600x1200&je=0&ul=en-US&cid=1191188413.1272248868

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 number| vph number| vpw object| jcc

18 Cookies

Domain/Path Name / Value
bedrapiona.com/ Name: OAID
Value: 6fbad7e3ea684c2fbcb96a04a7c455b2
bedrapiona.com/ Name: oaidts
Value: 1705660892
my.rtmark.net/ Name: ID
Value: 6fbad7e3ea684c2fbcb96a04a7c455b2
bedrapiona.com/ Name: syncedCookie
Value: true
wholefreshstories.com/ Name: oaidts
Value: 1705660892
wholefreshstories.com/ Name: syncedCookie
Value: true
wholefreshstories.com/ Name: OAID
Value: 2a14f46eec0eb6ff8934dbb57f70c112
wholefreshstories.com/ Name: prefetchAd_4662728
Value: true
wholefreshstories.com/ Name: reverse
Value: YduK6yY-TxWaaeaxQ6yckf1l2gVcMwtKjTwx_ImrbKE
.lnk.gameclickads.net/ Name: v
Value: t
.lnk.gameclickads.net/ Name: cas
Value: 4063:2209:2209:1
.lnk.gameclickads.net/ Name: rls
Value: 410860:2209:2209:1|412010:2209:2209:1
.lnk.gameclickads.net/ Name: com
Value: 9266:141:DE:2209:2209:1|14159:141:DE:2209:2209:1
.tradedoubler.com/ Name: EH_0
Value: 1z11z1z159z1k6M1Wz1UWZyae9cD8PyFV2oxjJpuYYpBgc3LbGEVp%79Mi8PHcZXuS%79oujlfDl71O0.LP.heq03hc15b0pD6RtSB41W83_SrUL8.xlr%7aEsUbRs3_8TG7OTkNITh%7a%7a8e3c2IjFhknIp1VJ
.tradedoubler.com/ Name: GUID
Value: 1z11zz159z1khoRnz571563a640807d756add4ce58b951941
.tradetracker.net/ Name: uf
Value: b5F2Xr9KL9t8thgo2DDd4EI0Zi92MGJPTlBLN3RzK0FBdnpLNTkxQ09NSGpiT2I3bnA5OVQyQkJ1bitianJXWlNzQ2JWQ2YwM2RrTGFUWjNUVVArd2dlQ3dqczB3VjhmRllxblBnPT0%3D
.tradetracker.net/ Name: __tdat34812
Value: MTcwNTY2MDg5NTo6MDo6MTQ3NzIwOjp2MDMwNDAwMDE2NTU5Njc0M2RkYzg2YTFlNGI5MTliY2E3YTBjODZjOGIxMzc6OmY6OmFmMWIxMjA2Yjc4MzYyNTZhZTNlODFhN2NhMzQ5YzE1
.tradetracker.net/ Name: __tgdat514
Value: MTcwNTY2MDg5NTo6MDo6MTQ3NzIwOjp2MDMwNDAwMDE2NTU5Njc0M2RkYzg2YTFlNGI5MTliY2E3YTBjODZjOGIxMzc6OmY6OmFmMWIxMjA2Yjc4MzYyNTZhZTNlODFhN2NhMzQ5YzE1_34812

3 Console Messages

Source Level URL
Text
security error URL: https://r.linksprf.com/v2/go?t=mtcpw%3An%2Fochtaateur.cweF.%25e2%2FAc%253t8h2um701a8167c2a%26a%3Db010b0e0a685d6347d9c5611044939vcr700784c%3Db%263%3D%26%26%3D1t4p%3D3%3F%25tFn2rwkwajtsdfrs.itn%2Fos.toh&e=1&ai=d5099d43fa604a7190944ea9bbb3bfee&sct=0&ct=1705660894894&cu=6743ddc86a1e4b919bca7a0c86c8b137&ykuid=06129672e43a4de58f43d5758c27817e&sc=1&cs=e249bb133f2860566ac1d5882ded34e3(Line 17)
Message:
Mixed Content: The page at 'https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&device=desktop&operatingSystem=windows&osVersion=win10&country=DE&language=de&userAgent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/120.0.6099.224%20Safari/537.36&browser=chrome&zoneId=4662728&cost=0.000015&campaignId=7848593&paid=772160355228196924&subzone_id=111194&oaid=2a14f46eec0eb6ff8934dbb57f70c112' was loaded over HTTPS, but requested an insecure frame 'http://www.justfashionnow.com/?utm_source=Affiliate&utm_medium=TT&utm_campaign=DE&utm_content=147720&utm_term=03720'. This request has been blocked; the content must be served over HTTPS.
other error URL: chrome-error://chromewebdata/
Message:
Refused to display 'https://www.goboony.de/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
security error URL: https://r.linksprf.com/v2/go?t=mtcpw%3An%2Fochtaateur.cweF.%25e2%2FAc%253t8h2um701a8167c2a%26a%3Db010b0e0a685d6347d9c5611044939vcr700784c%3Db%263%3D%26%26%3D1t4p%3D3%3F%25tFn2rwkwajtsdfrs.itn%2Fos.toh&e=1&ai=d5099d43fa604a7190944ea9bbb3bfee&sct=0&ct=1705660894894&cu=6743ddc86a1e4b919bca7a0c86c8b137&ykuid=06129672e43a4de58f43d5758c27817e&sc=1&cs=e249bb133f2860566ac1d5882ded34e3(Line 17)
Message:
Mixed Content: The page at 'https://bnr.hyperadsdesign.com/get/1vkj4Qw2yULtN68JYfUrpZFr?connectionType=broadband&carrier=?&browserVersion=120&region=be&device=desktop&operatingSystem=windows&osVersion=win10&country=DE&language=de&userAgent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/120.0.6099.224%20Safari/537.36&browser=chrome&zoneId=4662728&cost=0.000015&campaignId=7848593&paid=772160355228196924&subzone_id=111194&oaid=2a14f46eec0eb6ff8934dbb57f70c112' was loaded over HTTPS, but requested an insecure frame 'http://www.justfashionnow.com/?utm_source=Affiliate&utm_medium=TT&utm_campaign=DE&utm_content=147720&utm_term=03720'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bedrapiona.com
bnr.hyperadsdesign.com
clk.tradedoubler.com
d38dxwbthvbuvi.cloudfront.net
datatechone.com
lnk.gameclickads.net
my.rtmark.net
r.linksprf.com
tc.tradetracker.net
wholefreshstories.com
www.goboony.de
www.google-analytics.com
zenoanime.onionlive.workers.dev
tc.tradetracker.net
www.google-analytics.com
139.45.195.253
139.45.195.8
139.45.197.234
18.196.16.121
18.197.221.185
188.114.96.3
2600:9000:223d:fe00:c:cb59:380:21
2606:4700:20::681a:dd7
2606:4700:3034::ac43:8d6c
2a00:1450:4001:830::200e
2a06:98c1:3121::3
35.171.199.139
068672e2dac1a3b8eda31f1259c36d47e47e68959ca195e8d326aacaa06cc4e0
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
28386fa62202a4edbdb69c5ef9f9917c014c522a5395d36fb7f178df7b6d935c
3f63d12976eb31386ce4c926fa8bee5e107f5a7f61b015630cffe8f013c345cd
41073afd70d67192731d0e6330e0c56eef44eac903dca4baa6b319d8a87928ed
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44ff45ab2bba4f5bbffb365098ca83552c82d0b660686ff00db541eb7aed9344
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f316c8c4d24d7fe2b25d14256ad9bdce7fe0a1eac83e1ddfc7b190d942a8bf4
56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc
5ae9c209c8eeb635a6e25ace70b0b786fcdd97220fcbf806c64e0b5efe69bbf0
6e83e1f52e881be62e37c8bc3ac3a5fc98b8a2f5f6adad51425f184a6cf1036c
73bb863239e7deafca0188b7a37efed56fec31a9f71d33cf253793c1e2738a34
7477ac78ac73b6aa09eae50de3045d56875f911e3ba933149b15a82016c6935f
7946242972b39bead0390fe88b1673d58bf7d31641e4ae34132aff341335156c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9abacf1a41dd7738c0834d9d86bea8f1e1b11f8baf25a698c55582ba4f12320b
a0310767183d60f5f8ca30b0c1c1e9f5fe13e9601d6557216c528306f6f3b7e9
b968694c2bb18e5ab881d4e65c0881e8978c9444911c91dd6e2cfdc9e2707ad3
d00b15540694cec208556abcc6dffa35a3332f428d420fc13cf073addb957fdc
e062b3bee6b009a75a224fcd19209cd54676be993cfdbf26e4ac9e3d71b3ea06
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e762d6ca1ddd7dab2fa0db7702efdbd3bc10e6f7f3be7b0f8818d45d5bcb96d7
f4355d0e413c8cb3d1065019dad2460714f9cb592726dec495b414da91d22b05