go.wwof.com Open in urlscan Pro
35.174.151.106 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bobitenews.com/portal/wts/uemcmPygAtmbbRr0aFyMEq|vzy|Fmh8FNRrr3TO0Td
Effective URL:
https://go.wwof.com/dickies/canvas
Submission: On March 07 via api (March 7th 2022, 6:16:02 pm UTC) from US — Scanned from DE

Summary HTTP 29 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 12 domains to perform 29 HTTP transactions. The main IP is 35.174.151.106, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is go.wwof.com. The Cisco Umbrella rank of the primary domain is 939925.
TLS certificate: Issued by R3 on January 25th 2022. Valid for: 3 months.

This is the only time go.wwof.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	205.162.45.46 205.162.45.46	53866 (QTS-AS) (QTS-AS)
4	2606:4700:20:... 2606:4700:20::681a:fcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5f41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5 5	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
8 12	35.174.151.106 35.174.151.106	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
7	2600:9000:224... 2600:9000:224a:4000:d:7e9b:1200:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:401... 2a00:1450:4016:80a::2003	15169 (GOOGLE) (GOOGLE)
29	13

1 205.162.45.46 (United States) 1 redirects

ASN53866 (QTS-AS, US)
PTR: mailsrv4546.o-mx.com

bobitenews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:20::681a:fcf (United States)

ASN13335 (CLOUDFLARENET, US)

click.bobitstudios.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.181.226 (United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 35.174.151.106 (Ashburn, United States) 8 redirects

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-4-ue1.aws.pardot.com

go.wwof.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:224a:4000:d:7e9b:1200:93a1 (United States)

ASN16509 (AMAZON-02, US)

storage.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4016:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	wwof.com 8 redirects go.wwof.com — Cisco Umbrella Rank: 939925	19 KB
9	pardot.com storage.pardot.com — Cisco Umbrella Rank: 8541 pi.pardot.com	1 MB
6	doubleclick.net 5 redirects pubads.g.doubleclick.net — Cisco Umbrella Rank: 494 googleads.g.doubleclick.net — Cisco Umbrella Rank: 38	2 KB
4	bobitstudios.com click.bobitstudios.com — Cisco Umbrella Rank: 433365	13 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35 ajax.googleapis.com — Cisco Umbrella Rank: 251	99 KB
2	googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 122	82 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6433	548 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	548 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 101	15 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 54	40 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1207	5 KB
1	bobitenews.com 1 redirects bobitenews.com — Cisco Umbrella Rank: 291668	347 B
29	12

	Domain	Requested by
10	go.wwof.com	8 redirects click.bobitstudios.com go.wwof.com pi.pardot.com
7	storage.pardot.com	go.wwof.com
5	pubads.g.doubleclick.net	5 redirects
4	click.bobitstudios.com	click.bobitstudios.com static.cloudflareinsights.com
2	pi.pardot.com	go.wwof.com pi.pardot.com
2	ajax.googleapis.com	go.wwof.com
2	tpc.googlesyndication.com	click.bobitstudios.com
1	www.google.de	go.wwof.com
1	www.google.com	go.wwof.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	fonts.googleapis.com	go.wwof.com
1	www.googletagmanager.com	go.wwof.com
1	static.cloudflareinsights.com	click.bobitstudios.com
1	bobitenews.com	1 redirects
29	15

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-21` - `2022-06-20`	a year	crt.sh
go.wwof.com R3	`2022-01-25` - `2022-04-25`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
pi.pardot.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-08` - `2022-11-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://go.wwof.com/dickies/canvas
Frame ID: 8CFBB5DD9DD1F69A8D5F812FFE4756C2
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://bobitenews.com/portal/wts/uemcmPygAtmbbRr0aFyMEq%7Cvzy%7CFmh8FNRrr3TO0Td HTTP 302
https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topn... Page URL
https://pubads.g.doubleclick.net/gampad/jump?iu=/86855500/inline02&sz=468x120&t=enewsletter%3Dhdt_topnews&c=[... HTTP 302
https://go.wwof.com/kpmo2/dickies/canvas HTTP 302
https://go.wwof.com/dickies/canvas Page URL

Detected technologies

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

29
Requests

59 %
HTTPS

71 %
IPv6

12
Domains

15
Subdomains

13
IPs

3
Countries

1571 kB
Transfer

1974 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bobitenews.com/portal/wts/uemcmPygAtmbbRr0aFyMEq%7Cvzy%7CFmh8FNRrr3TO0Td HTTP 302
https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z Page URL
https://pubads.g.doubleclick.net/gampad/jump?iu=/86855500/inline02&sz=468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z HTTP 302
https://go.wwof.com/kpmo2/dickies/canvas HTTP 302
https://go.wwof.com/dickies/canvas Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://bobitenews.com/portal/wts/uemcmPygAtmbbRr0aFyMEq%7Cvzy%7CFmh8FNRrr3TO0Td HTTP 302
https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z

Request Chain 4

https://pubads.g.doubleclick.net/gampad/ad?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z HTTP 302
https://pubads.g.doubleclick.net/gampad/ad?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z&pre=1 HTTP 302
https://tpc.googlesyndication.com/simgad/785344585206440597

Request Chain 6

https://pubads.g.doubleclick.net/gampad/ad?iu=/86855500/inline02&sz=468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z HTTP 302
https://pubads.g.doubleclick.net/gampad/ad?iu=/86855500/inline02&sz=468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z&pre=1 HTTP 302
https://tpc.googlesyndication.com/simgad/785344585206440597

Request Chain 12

https://go.wwof.com/l/213771/2022-02-06/21bfgw/213771/1644189787Z4TR2Hj5/dickies_logo_22.png HTTP 302
https://storage.pardot.com/213771/1644189787Z4TR2Hj5/dickies_logo_22.png

Request Chain 13

https://go.wwof.com/l/213771/2022-02-22/21pqmw/213771/1645583024ZZ7LBcFu/dk_22_pm_hero_text.png HTTP 302
https://storage.pardot.com/213771/1645583024ZZ7LBcFu/dk_22_pm_hero_text.png

Request Chain 14

https://go.wwof.com/l/213771/2022-02-22/21pqmh/213771/1645581369fRZKCYy8/dk_22_pm_text.png HTTP 302
https://storage.pardot.com/213771/1645581369fRZKCYy8/dk_22_pm_text.png

Request Chain 15

https://go.wwof.com/l/213771/2022-02-22/21pqmp/213771/1645581370ZGvrPnmW/dk_22_pm_specs.png HTTP 302
https://storage.pardot.com/213771/1645581370ZGvrPnmW/dk_22_pm_specs.png

Request Chain 18

https://go.wwof.com/l/213771/2022-02-22/21pqmk/213771/1645581369oETo2ihR/dk_22_pm_hero_l.jpg HTTP 302
https://storage.pardot.com/213771/1645581369oETo2ihR/dk_22_pm_hero_l.jpg

Request Chain 19

https://go.wwof.com/l/213771/2022-02-22/21pqmm/213771/16455813697euOqe6R/dk_22_pm_hero_r.jpg HTTP 302
https://storage.pardot.com/213771/16455813697euOqe6R/dk_22_pm_hero_r.jpg

Request Chain 20

https://go.wwof.com/l/213771/2022-02-22/21pqmr/213771/16455816252LfgELPk/dk_22_pm_con_bg.jpg HTTP 302
https://storage.pardot.com/213771/16455816252LfgELPk/dk_22_pm_con_bg.jpg

29 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

ad.html Show response
click.bobitstudios.com/dfp/
Redirect Chain

https://bobitenews.com/portal/wts/uemcmPygAtmbbRr0aFyMEq%7Cvzy%7CFmh8FNRrr3TO0Td
https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z

3 KB
2 KB

947ms
415ms

Document
text/html

2606:4700:20::681a:fcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:fcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 8493d3769f99887d17aa3570e58691c2c6554cf0ff80f816808e667ce2462761

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Mon, 07 Mar 2022 18:15:55 GMT
content-type: text/html
cf-ray: 6e8551bb2f1f9a1e-FRA
last-modified: Mon, 24 Sep 2018 18:38:47 GMT
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-powered-by: ASP.NET
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=anczLI1Rd7kOtYFlMB7GpnRJo6nK0rEi%2ByIWVU5%2FY5lFYV76eZP6shu45g2I9n%2F7GBM3wFTZ6jce%2BS6%2FE3K7ISzwHZ7QoYbO7JuBxoAHR1sAy8Niru0Ina7b6X%2BCyW0QDgVbOhhQ%2FUl%2F9O3r%2BQ11SMwf1C4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Location: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
Content-Length: 0
Date: Mon, 07 Mar 2022 19:15:54 CET
Server: Apache

GET
H2 200 api.js Show response
click.bobitstudios.com/cdn-cgi/bm/cv/669835187/ 35 KB
9 KB 34ms
33ms Script
text/javascript 2606:4700:20::681a:fcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://click.bobitstudios.com/cdn-cgi/bm/cv/669835187/api.js

Requested by

Host: click.bobitstudios.com
URL: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ad73612f12f05dfb07d437a5d3d9a19c5ed14ced0b78362eadd9ac8effde3ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tYVVlSEcbmHoJ%2FcsFRM2XB4RKXvtDyVaDYKj2geBXLniC5D1xppaUPgLJbG83%2Fzt43rilZwQF%2BVUVK31hMgn%2BXX9uhNa6rA4H0Lqj3RNIvbDPRrNinTyCRtv3x%2BfpnPhvsAnjRQcTPLDwcvRqt%2BBiuCYls8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=604800, public
cf-ray: 6e8551bdee009a1e-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 ads.js Show response
click.bobitstudios.com/Scripts/ 123 B
489 B 245ms
245ms Script
application/javascript 2606:4700:20::681a:fcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://click.bobitstudios.com/Scripts/ads.js
Requested by: Host: click.bobitstudios.com
URL: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:fcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 211c0c9ed22b7272b2f5405ac28d36a0dbd458c139f6e16171ebdf303b468875

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:56 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: MISS
last-modified: Sat, 22 Sep 2018 00:17:56 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"b9331bb6952d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LNrIvrqGKfQpuzZpMS0pz7Btktg18sSGCNX7TXwALYQM5AgNkD%2F6CfTn4c%2BkOqvt0dr36vI7miP4D3ML0RIjYe%2FBwi26%2F%2Bc5DXh8ScjrcLSNFPtawjJV%2F7X4ONAThY%2BoYvOUY5GqGxdbqN10AhAsMb6OOzg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 6e8551bdee039a1e-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 111ms
67ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: click.bobitstudios.com
URL: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://click.bobitstudios.com/
Origin: https://click.bobitstudios.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:55 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6e8551be39b9696a-FRA

GET
H2

200

785344585206440597
tpc.googlesyndication.com/simgad/
Redirect Chain

https://pubads.g.doubleclick.net/gampad/ad?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
https://pubads.g.doubleclick.net/gampad/ad?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z&pre=1
https://tpc.googlesyndication.com/simgad/785344585206440597?

41 KB
41 KB

123ms
82ms

Image
image/jpeg

2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/785344585206440597?

Requested by

Host: click.bobitstudios.com
URL: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z

Protocol

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

530fcbefb67bb82d37ee6da608ed1b3d97fa4b9de51c1c5881059c81039c65ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://click.bobitstudios.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:56 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41903
x-xss-protection: 0
last-modified: Thu, 03 Mar 2022 17:24:37 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 07 Mar 2023 18:15:56 GMT

Redirect headers

date: Mon, 07 Mar 2022 18:15:56 GMT
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
google-lineitem-id: 5929939349
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138383849800
content-type: text/html; charset=UTF-8
location: https://tpc.googlesyndication.com/simgad/785344585206440597?
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 result Show response
click.bobitstudios.com/cdn-cgi/bm/cv/ 0
745 B 25ms
24ms XHR
text/plain 2606:4700:20::681a:fcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://click.bobitstudios.com/cdn-cgi/bm/cv/result?req_id=6e8551bb2f1f9a1e
Requested by: Host: click.bobitstudios.com
URL: https://click.bobitstudios.com/cdn-cgi/bm/cv/669835187/api.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:fcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 07 Mar 2022 18:15:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xv8faEVQKURKp4tKwvVLHZr1nCAofN0BEqJEuBeL8zqmkv6f84T9%2Fr5hg%2FqK8rjaa8fRNyAiWXlRDBvUrEJO9qeIutckps42dWQVvogEhqAV%2F77bDkfDpW93HpDE5GvCaXgJ7iQucsfECwCtX6%2F1s3qePUg%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 6e8551bfe8689130-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3

200

785344585206440597
tpc.googlesyndication.com/simgad/
Redirect Chain

https://pubads.g.doubleclick.net/gampad/ad?iu=/86855500/inline02&sz=468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
https://pubads.g.doubleclick.net/gampad/ad?iu=/86855500/inline02&sz=468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z&pre=1
https://tpc.googlesyndication.com/simgad/785344585206440597?

41 KB
41 KB

41ms
16ms

Image
image/jpeg

2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/785344585206440597?

Requested by

Host: click.bobitstudios.com
URL: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z

Protocol

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://click.bobitstudios.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:56 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41903
x-xss-protection: 0
last-modified: Thu, 03 Mar 2022 17:24:37 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 07 Mar 2023 18:15:56 GMT

Redirect headers

date: Mon, 07 Mar 2022 18:15:56 GMT
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
google-lineitem-id: 5929939349
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138383849800
content-type: text/html; charset=UTF-8
location: https://tpc.googlesyndication.com/simgad/785344585206440597?
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

Primary Request canvas Show response
go.wwof.com/dickies/
Redirect Chain

https://pubads.g.doubleclick.net/gampad/jump?iu=/86855500/inline02&sz=468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
https://go.wwof.com/kpmo2/dickies/canvas
https://go.wwof.com/dickies/canvas

50 KB
13 KB

301ms
300ms

Document
text/html

35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://go.wwof.com/dickies/canvas
Requested by: Host: click.bobitstudios.com
URL: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-4-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 0eaf4af8e5919dc4ae12436e5313b7ea0797ecda2ea956acdb17c9db19f725e5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://click.bobitstudios.com/dfp/ad.html?iu=/86855500/inline02&sz=468x60|468x120&t=enewsletter%3Dhdt_topnews&c=[TIMESTAMP]&oly_enc_id=6799B5340667D9Z

Response headers

date: Mon, 07 Mar 2022 18:15:57 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
status: 404 Not Found
x-pardot-rsp: 0/0/1
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 11984
content-type: text/html; charset=utf-8
X-Pardot-Route: 07c6fec365d81c66b16ef70448a47c0a
Server: PardotServer
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24

Redirect headers

date: Mon, 07 Mar 2022 18:15:57 GMT
location: https://go.wwof.com/dickies/canvas
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control: no-store
expires: Mon, 07 Mar 2022 18:05:57 GMT
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 108
content-type: text/html; charset=UTF-8
X-Pardot-Route: 07c6fec365d81c66b16ef70448a47c0a
Server: PardotServer
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24

POST rum
click.bobitstudios.com/cdn-cgi/ 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 99 KB
40 KB 74ms
33ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-336943332

Requested by

Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cba22b4cc6fd5c1410075247282bbd331fe6e77b884f6b01046494ef77aaae9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40066
x-xss-protection: 0
last-modified: Mon, 07 Mar 2022 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 07 Mar 2022 18:15:58 GMT

GET
H2 200 css
fonts.googleapis.com/ 16 KB
1 KB 65ms
26ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,600,700,300i,600i,700i|Raleway:600,800

Requested by

Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

66985ecf1b9cd339904a01095dcee6d46e9fc3ea8afa0d61d29150598b79cde9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 07 Mar 2022 18:15:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 07 Mar 2022 18:15:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 07 Mar 2022 18:15:58 GMT

GET css2
go.wwof.com/dickies/ulr(%22https://fonts.googleapis.com/ 0
0

GET
H2

200

dickies_logo_22.png
storage.pardot.com/213771/1644189787Z4TR2Hj5/
Redirect Chain

https://go.wwof.com/l/213771/2022-02-06/21bfgw/213771/1644189787Z4TR2Hj5/dickies_logo_22.png
https://storage.pardot.com/213771/1644189787Z4TR2Hj5/dickies_logo_22.png

20 KB
21 KB

548ms
479ms

Image
image/png

2600:9000:224a:4000:d:7e9b:1200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.pardot.com/213771/1644189787Z4TR2Hj5/dickies_logo_22.png
Requested by: Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas
Protocol: H2
Server: 2600:9000:224a:4000:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 095546974c5c2bd09b98e9aa2b4a83831cf569af2cc15e4716f88b518ed08bf9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:59 GMT
via: 1.1 ed18d8ae19db26837eda53bbf8f03c08.cloudfront.net (CloudFront)
last-modified: Sun, 06 Feb 2022 23:23:08 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
etag: "f31186898e9d1e1c78fe6a9b4af7e46c"
x-cache: Miss from cloudfront
content-type: image/png; charset=binary
x-amz-replication-status: COMPLETED
content-length: 20951
accept-ranges: bytes
x-robots-tag: none
x-amz-version-id: pWjKD4Cs1XfbHTDrqdBYFRk9baBkiHxB
x-amz-cf-id: zf-w4KxdMLilSvrqcCNvCc5PiAPR4b9bwAtaoeEAi3vnhCpBGVDxbw==

Redirect headers

date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: gzip
X-Pardot-Route: 07c6fec365d81c66b16ef70448a47c0a
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Server: PardotServer
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
location: https://storage.pardot.com/213771/1644189787Z4TR2Hj5/dickies_logo_22.png
cache-control: max-age=600
x-robots-tag: none
content-length: 145
expires: Mon, 07 Mar 2022 18:25:58 GMT

GET
H2

200

dk_22_pm_hero_text.png
storage.pardot.com/213771/1645583024ZZ7LBcFu/
Redirect Chain

https://go.wwof.com/l/213771/2022-02-22/21pqmw/213771/1645583024ZZ7LBcFu/dk_22_pm_hero_text.png
https://storage.pardot.com/213771/1645583024ZZ7LBcFu/dk_22_pm_hero_text.png

19 KB
20 KB

428ms
427ms

Image
image/png

2600:9000:224a:4000:d:7e9b:1200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.pardot.com/213771/1645583024ZZ7LBcFu/dk_22_pm_hero_text.png
Requested by: Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas
Protocol: H2
Server: 2600:9000:224a:4000:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 44bcdea3e1d2ed42fc4fd5002aa8f364f6134896a767c60d0a3429ae20645a02

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:59 GMT
via: 1.1 ed18d8ae19db26837eda53bbf8f03c08.cloudfront.net (CloudFront)
last-modified: Wed, 23 Feb 2022 02:23:45 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
etag: "fa97aad0836ec04d2feef963765ae98c"
x-cache: Miss from cloudfront
content-type: image/png; charset=binary
x-amz-replication-status: COMPLETED
content-length: 19763
accept-ranges: bytes
x-robots-tag: none
x-amz-version-id: 4GNrHSH_vCNBdMZIISLsA70gnCMwwXof
x-amz-cf-id: jCbGT-lpPyi8guOL7qLYfEIi0sPMnxsGpwrgNKYaXn0F4vr7I0xl1A==

Redirect headers

date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: gzip
X-Pardot-Route: aaac0c4aea543f8d4e69ceff646811f2
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Server: PardotServer
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
location: https://storage.pardot.com/213771/1645583024ZZ7LBcFu/dk_22_pm_hero_text.png
cache-control: max-age=600
x-robots-tag: none
content-length: 148
expires: Mon, 07 Mar 2022 18:25:58 GMT

GET
H2

200

dk_22_pm_text.png
storage.pardot.com/213771/1645581369fRZKCYy8/
Redirect Chain

https://go.wwof.com/l/213771/2022-02-22/21pqmh/213771/1645581369fRZKCYy8/dk_22_pm_text.png
https://storage.pardot.com/213771/1645581369fRZKCYy8/dk_22_pm_text.png

23 KB
23 KB

456ms
455ms

Image
image/png

2600:9000:224a:4000:d:7e9b:1200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.pardot.com/213771/1645581369fRZKCYy8/dk_22_pm_text.png
Requested by: Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas
Protocol: H2
Server: 2600:9000:224a:4000:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 34e9707adc4529c952abcddac8a5992e94c1dcb3fbb521b90b5cbacde24a553a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:59 GMT
via: 1.1 ed18d8ae19db26837eda53bbf8f03c08.cloudfront.net (CloudFront)
last-modified: Wed, 23 Feb 2022 01:56:10 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
etag: "6e1e35251d17f1ec6a2baac175c697b7"
x-cache: Miss from cloudfront
content-type: image/png; charset=binary
x-amz-replication-status: COMPLETED
content-length: 23492
accept-ranges: bytes
x-robots-tag: none
x-amz-version-id: I3bFb9CCRjn4u9k9QPyregXlcsxhFtsd
x-amz-cf-id: uyFbut_RK5GeILZWi2yXdiffYfw_Qbba71WwCO7m-M-lVnKVxO9YEg==

Redirect headers

date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: gzip
X-Pardot-Route: 07c6fec365d81c66b16ef70448a47c0a
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Server: PardotServer
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
location: https://storage.pardot.com/213771/1645581369fRZKCYy8/dk_22_pm_text.png
cache-control: max-age=600
x-robots-tag: none
content-length: 146
expires: Mon, 07 Mar 2022 18:25:58 GMT

GET
H2

200

dk_22_pm_specs.png
storage.pardot.com/213771/1645581370ZGvrPnmW/
Redirect Chain

https://go.wwof.com/l/213771/2022-02-22/21pqmp/213771/1645581370ZGvrPnmW/dk_22_pm_specs.png
https://storage.pardot.com/213771/1645581370ZGvrPnmW/dk_22_pm_specs.png

496 KB
498 KB

474ms
474ms

Image
image/png

2600:9000:224a:4000:d:7e9b:1200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.pardot.com/213771/1645581370ZGvrPnmW/dk_22_pm_specs.png
Requested by: Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas
Protocol: H2
Server: 2600:9000:224a:4000:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c8b18698c243ed284dcf64427d5a7ef58b3fcccb99e5aba408c0721f35839ddf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:59 GMT
via: 1.1 ed18d8ae19db26837eda53bbf8f03c08.cloudfront.net (CloudFront)
last-modified: Wed, 23 Feb 2022 01:56:11 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
etag: "bb464a4cdff1217efadb3b4cd339a882"
x-cache: Miss from cloudfront
content-type: image/png; charset=binary
x-amz-replication-status: COMPLETED
content-length: 508394
accept-ranges: bytes
x-robots-tag: none
x-amz-version-id: 4w8HJJqV_MRUdOuggT8Ig3iQDJ4BqFOH
x-amz-cf-id: 0w4X3Vi6WJjkvTHkFaI_jlC1kxVVw1ncX9G4fChlkzcFpxph1PKYLQ==

Redirect headers

date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: gzip
X-Pardot-Route: 07c6fec365d81c66b16ef70448a47c0a
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Server: PardotServer
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
location: https://storage.pardot.com/213771/1645581370ZGvrPnmW/dk_22_pm_specs.png
cache-control: max-age=600
x-robots-tag: none
content-length: 144
expires: Mon, 07 Mar 2022 18:25:58 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 73ms
15ms Script
text/javascript 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 02 Mar 2022 14:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 444818
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Mar 2023 14:42:20 GMT

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ 248 KB
67 KB 89ms
32ms Script
text/javascript 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js

Requested by

Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 05 Mar 2022 13:20:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 190527
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67948
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 05 Mar 2023 13:20:31 GMT

GET
H2

200

dk_22_pm_hero_l.jpg
storage.pardot.com/213771/1645581369oETo2ihR/
Redirect Chain

https://go.wwof.com/l/213771/2022-02-22/21pqmk/213771/1645581369oETo2ihR/dk_22_pm_hero_l.jpg
https://storage.pardot.com/213771/1645581369oETo2ihR/dk_22_pm_hero_l.jpg

119 KB
120 KB

470ms
470ms

Image
image/jpeg

2600:9000:224a:4000:d:7e9b:1200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.pardot.com/213771/1645581369oETo2ihR/dk_22_pm_hero_l.jpg
Requested by: Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas
Protocol: H2
Server: 2600:9000:224a:4000:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2b1dd1c47b8aa86f91b2d291206c51c4b89edb4f433f42329850581f760fa16a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:59 GMT
via: 1.1 ed18d8ae19db26837eda53bbf8f03c08.cloudfront.net (CloudFront)
last-modified: Wed, 23 Feb 2022 01:56:10 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
etag: "9abc8893f3fdf154473ca6cb53d18780"
x-cache: Miss from cloudfront
content-type: image/jpeg; charset=binary
x-amz-replication-status: COMPLETED
content-length: 122202
accept-ranges: bytes
x-robots-tag: none
x-amz-version-id: JwIt9dFSwXfMMV5Tj3Q9G7WlAwsEOJI_
x-amz-cf-id: gVmIn45k71SuEtSvnwZzH_RzomWph-YAxigN7FVOEddmdAEboV0cnQ==

Redirect headers

date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: gzip
X-Pardot-Route: 07c6fec365d81c66b16ef70448a47c0a
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Server: PardotServer
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
location: https://storage.pardot.com/213771/1645581369oETo2ihR/dk_22_pm_hero_l.jpg
cache-control: max-age=600
x-robots-tag: none
content-length: 144
expires: Mon, 07 Mar 2022 18:25:58 GMT

GET
H2

200

dk_22_pm_hero_r.jpg
storage.pardot.com/213771/16455813697euOqe6R/
Redirect Chain

https://go.wwof.com/l/213771/2022-02-22/21pqmm/213771/16455813697euOqe6R/dk_22_pm_hero_r.jpg
https://storage.pardot.com/213771/16455813697euOqe6R/dk_22_pm_hero_r.jpg

282 KB
283 KB

481ms
480ms

Image
image/jpeg

2600:9000:224a:4000:d:7e9b:1200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.pardot.com/213771/16455813697euOqe6R/dk_22_pm_hero_r.jpg
Requested by: Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas
Protocol: H2
Server: 2600:9000:224a:4000:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ab6357ea91b663d62e03ec33bb954ed44a8d0edf76bd9e210082f96cfb48f572

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:59 GMT
via: 1.1 ed18d8ae19db26837eda53bbf8f03c08.cloudfront.net (CloudFront)
last-modified: Wed, 23 Feb 2022 01:56:10 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
etag: "1d856f323abc0c76db403e88c7ed6195"
x-cache: Miss from cloudfront
content-type: image/jpeg; charset=binary
x-amz-replication-status: COMPLETED
content-length: 288905
accept-ranges: bytes
x-robots-tag: none
x-amz-version-id: _s1vi8P4e2105Sx9MPkKP5AczOb6cjoX
x-amz-cf-id: nhzjTq4IM3ZpalDoDAkioPECfFbC0VBrZGDEcuWVvM5GcrRUpXLWaQ==

Redirect headers

date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: gzip
X-Pardot-Route: 07c6fec365d81c66b16ef70448a47c0a
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Server: PardotServer
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
location: https://storage.pardot.com/213771/16455813697euOqe6R/dk_22_pm_hero_r.jpg
cache-control: max-age=600
x-robots-tag: none
content-length: 144
expires: Mon, 07 Mar 2022 18:25:58 GMT

GET
H2

200

dk_22_pm_con_bg.jpg
storage.pardot.com/213771/16455816252LfgELPk/
Redirect Chain

https://go.wwof.com/l/213771/2022-02-22/21pqmr/213771/16455816252LfgELPk/dk_22_pm_con_bg.jpg
https://storage.pardot.com/213771/16455816252LfgELPk/dk_22_pm_con_bg.jpg

330 KB
331 KB

553ms
553ms

Image
image/jpeg

2600:9000:224a:4000:d:7e9b:1200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.pardot.com/213771/16455816252LfgELPk/dk_22_pm_con_bg.jpg
Requested by: Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas
Protocol: H2
Server: 2600:9000:224a:4000:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 57c94771b6cb1a0316e23f9039f15df8101113085390bae8c12e4098c563ba7b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:59 GMT
via: 1.1 ed18d8ae19db26837eda53bbf8f03c08.cloudfront.net (CloudFront)
last-modified: Wed, 23 Feb 2022 02:00:26 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
etag: "b69939fcd041c7060382901f8eed1d4f"
x-cache: Miss from cloudfront
content-type: image/jpeg; charset=binary
x-amz-replication-status: COMPLETED
content-length: 338011
accept-ranges: bytes
x-robots-tag: none
x-amz-version-id: .JuUqWcQSOe3Z8jBG5jaG0sjL8XxvAxC
x-amz-cf-id: S18sVxVWT3wJ6UiJnjxeYJgn_lv0miRt7ajTbIQ0IhkqmvFfOYokIQ==

Redirect headers

date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: gzip
X-Pardot-Route: 07c6fec365d81c66b16ef70448a47c0a
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Server: PardotServer
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
location: https://storage.pardot.com/213771/16455816252LfgELPk/dk_22_pm_con_bg.jpg
cache-control: max-age=600
x-robots-tag: none
content-length: 144
expires: Mon, 07 Mar 2022 18:25:58 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 86ms
44ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-336943332

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

083ec931e5517a4ab713afbe9561e72b9186cb54e21b8b1eface9caefb54a966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14879
x-xss-protection: 0
server: cafe
etag: 17635014576153706337
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 07 Mar 2022 18:15:58 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/336943332/ 2 KB
2 KB 75ms
34ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/336943332/?random=1646676958295&cv=9&fst=1646676958295&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa320&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fgo.wwof.com%2Fdickies%2Fcanvas&ref=https%3A%2F%2Fclick.bobitstudios.com%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bab396dde9c3cb5d4f770b8daf55c7f11d813eb564c1ff289765d42880340a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Mar 2022 18:15:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1034
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/336943332/ 42 B
548 B 88ms
46ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/336943332/?random=1646676958295&cv=9&fst=1646676000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa320&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fgo.wwof.com%2Fdickies%2Fcanvas&ref=https%3A%2F%2Fclick.bobitstudios.com%2F&async=1&fmt=3&is_vtc=1&random=822936718&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Mar 2022 18:15:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/336943332/ 42 B
548 B 107ms
46ms Image
image/gif 2a00:1450:4016:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/336943332/?random=1646676958295&cv=9&fst=1646676000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa320&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fgo.wwof.com%2Fdickies%2Fcanvas&ref=https%3A%2F%2Fclick.bobitstudios.com%2F&async=1&fmt=3&is_vtc=1&random=822936718&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4016:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Mar 2022 18:15:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 416ms
102ms Script
application/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: go.wwof.com
URL: https://go.wwof.com/dickies/canvas
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-4-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: d2a0ed3481f0594245bc42536efbad044afe679a3f5a7993eb09774b94dc305c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 18:15:59 GMT
content-encoding: gzip
X-Pardot-Route: 8f46b7608980401223b1d0300f1fdf0e
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
last-modified: Mon, 07 Mar 2022 05:17:51 GMT
Server: PardotServer
etag: "1547-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=63072000
accept-ranges: bytes
content-length: 1950
expires: Wed, 06 Mar 2024 18:15:59 GMT

GET
H/1.1 200
OK analytics Show response
pi.pardot.com/ 3 KB
3 KB 448ms
448ms Script
text/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://pi.pardot.com/analytics?ver=3&visitor_id=238030614&visitor_id_sign=5ba166296adf0bec07c44de43d0cb5de2a120cdc4cdb0a701ce466b16b5283d8d687a72f4f9fe88bf420b82c6d316141d0ce344a&pi_opt_in=&campaign_id=43354&account_id=214771&title=&url=https%3A%2F%2Fgo.wwof.com%2Fdickies%2Fcanvas&referrer=https%3A%2F%2Fclick.bobitstudios.com%2F

Requested by

Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

pi0-lba1-4-ue1.aws.pardot.com

Software

PardotServer /

Resource Hash

8cf50d51ebc88511f8c0e8ed599a30df52e6822bccd6dd1d8affd59e1d55bd3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Mar 2022 18:15:59 GMT
content-encoding: gzip
X-Pardot-Route: 403edde838d926b2f64a33ea88db7473
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
x-pardot-rsp: 0/0/1
vary: Accept-Encoding,User-Agent
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 1443
Server: PardotServer
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK analytics Show response
go.wwof.com/ 50 B
1022 B 246ms
246ms Script
text/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://go.wwof.com/analytics?conly=true&visitor_id=238030614&visitor_id_sign=5ba166296adf0bec07c44de43d0cb5de2a120cdc4cdb0a701ce466b16b5283d8d687a72f4f9fe88bf420b82c6d316141d0ce344a&pi_opt_in=&campaign_id=43354&account_id=214771&title=&url=https%3A%2F%2Fgo.wwof.com%2Fdickies%2Fcanvas&referrer=https%3A%2F%2Fclick.bobitstudios.com%2F
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/analytics?ver=3&visitor_id=238030614&visitor_id_sign=5ba166296adf0bec07c44de43d0cb5de2a120cdc4cdb0a701ce466b16b5283d8d687a72f4f9fe88bf420b82c6d316141d0ce344a&pi_opt_in=&campaign_id=43354&account_id=214771&title=&url=https%3A%2F%2Fgo.wwof.com%2Fdickies%2Fcanvas&referrer=https%3A%2F%2Fclick.bobitstudios.com%2F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-4-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.wwof.com/dickies/canvas
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Mar 2022 18:16:00 GMT
X-Pardot-Route: 403edde838d926b2f64a33ea88db7473
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
x-pardot-rsp: 0/0/1
vary: User-Agent
p3p: CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control: no-store, no-cache, must-revalidate
content-type: text/javascript; charset=utf-8
content-length: 50
Server: PardotServer
expires: Thu, 19 Nov 1981 08:52:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: click.bobitstudios.com
URL: https://click.bobitstudios.com/cdn-cgi/rum?

Domain: click.bobitstudios.com
URL: https://click.bobitstudios.com/cdn-cgi/rum?

Domain: go.wwof.com
URL: https://go.wwof.com/dickies/ulr(%22https://fonts.googleapis.com/css2?family=Oswald:wght@200;300;400;500;600;700&family=Public+Sans:ital,wght@0,100;0,200;0,300;0,400;0,500;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500&family=Roboto+Mono:wght@300;400%22)

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
click.bobitstudios.com/	1969-12-31 23:59:59	Name: ServerID Value: 1024
.bobitstudios.com/	1970-01-20 01:24:38	Name: __cf_bm Value: 1bLRi2VTc9kRctQDzt17pW8YTqZELo7gKQ7WLrGPBZM-1646676956-0-AcYkwOv78jlWrIH/3t6atnXtJXrA5tcIWX5sm4s/e6h/puU8527mthJ16t3NDfHuEXKQ+dTdVwH18B2xAge7Kd4Sc7yvBuDgKhM2le2Wh1khES86pQqIv5FBumRh8oJqdA==
.doubleclick.net/	1970-01-20 10:46:12	Name: IDE Value: AHWqTUlSIWsyAF9A_J5KIaGr3IsQrlfBXWeWkR1FkhHMMwiVNJjoLuDHvFg9ToFtbVY
go.wwof.com/	1970-01-23 17:00:36	Name: visitor_id213771 Value: 238030614
go.wwof.com/	1970-01-23 17:00:36	Name: visitor_id213771-hash Value: 5ba166296adf0bec07c44de43d0cb5de2a120cdc4cdb0a701ce466b16b5283d8d687a72f4f9fe88bf420b82c6d316141d0ce344a
.wwof.com/	1970-01-20 03:34:12	Name: _gcl_au Value: 1.1.561857208.1646676958

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bobitenews.com
click.bobitstudios.com
fonts.googleapis.com
go.wwof.com
googleads.g.doubleclick.net
pi.pardot.com
pubads.g.doubleclick.net
static.cloudflareinsights.com
storage.pardot.com
tpc.googlesyndication.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
click.bobitstudios.com
go.wwof.com
142.250.181.226
142.250.186.98
205.162.45.46
2600:9000:224a:4000:d:7e9b:1200:93a1
2606:4700:20::681a:fcf
2606:4700::6810:5f41
2a00:1450:4001:800::200a
2a00:1450:4001:803::2004
2a00:1450:4001:810::200a
2a00:1450:4001:82a::2008
2a00:1450:4001:82f::2001
2a00:1450:4001:830::2002
2a00:1450:4016:80a::2003
35.174.151.106
083ec931e5517a4ab713afbe9561e72b9186cb54e21b8b1eface9caefb54a966
095546974c5c2bd09b98e9aa2b4a83831cf569af2cc15e4716f88b518ed08bf9
0eaf4af8e5919dc4ae12436e5313b7ea0797ecda2ea956acdb17c9db19f725e5
211c0c9ed22b7272b2f5405ac28d36a0dbd458c139f6e16171ebdf303b468875
2b1dd1c47b8aa86f91b2d291206c51c4b89edb4f433f42329850581f760fa16a
34e9707adc4529c952abcddac8a5992e94c1dcb3fbb521b90b5cbacde24a553a
44bcdea3e1d2ed42fc4fd5002aa8f364f6134896a767c60d0a3429ae20645a02
530fcbefb67bb82d37ee6da608ed1b3d97fa4b9de51c1c5881059c81039c65ef
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
57c94771b6cb1a0316e23f9039f15df8101113085390bae8c12e4098c563ba7b
5ad73612f12f05dfb07d437a5d3d9a19c5ed14ced0b78362eadd9ac8effde3ec
66985ecf1b9cd339904a01095dcee6d46e9fc3ea8afa0d61d29150598b79cde9
8493d3769f99887d17aa3570e58691c2c6554cf0ff80f816808e667ce2462761
8cf50d51ebc88511f8c0e8ed599a30df52e6822bccd6dd1d8affd59e1d55bd3a
ab6357ea91b663d62e03ec33bb954ed44a8d0edf76bd9e210082f96cfb48f572
bab396dde9c3cb5d4f770b8daf55c7f11d813eb564c1ff289765d42880340a16
c8b18698c243ed284dcf64427d5a7ef58b3fcccb99e5aba408c0721f35839ddf
cba22b4cc6fd5c1410075247282bbd331fe6e77b884f6b01046494ef77aaae9c
d2a0ed3481f0594245bc42536efbad044afe679a3f5a7993eb09774b94dc305c
dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

go.wwof.com Open in urlscan Pro 35.174.151.106 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

29 Requests

59 %HTTPS

71 %IPv6

12 Domains

15 Subdomains

13 IPs

3 Countries

1571 kBTransfer

1974 kBSize

6 Cookies

0 Outgoing links

Page URL History

Redirected requests

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

go.wwof.com Open in urlscan Pro
35.174.151.106 Public Scan

Screenshot
Live screenshot

Full Image

29
Requests

59 %
HTTPS

71 %
IPv6

12
Domains

15
Subdomains

13
IPs

3
Countries

1571 kB
Transfer

1974 kB
Size

6
Cookies

29 HTTP transactions
0 data transactions