login.newscorpaustralia.com Open in urlscan Pro
104.111.230.77 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://myaccount.news.com.au/heraldsun/viewAccount?cid=19021054
Effective URL:
https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFV...
Submission: On March 18 via manual (March 18th 2022, 9:07:55 pm UTC) from AU — Scanned from DE

Summary HTTP 87 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 26 IPs in 7 countries across 30 domains to perform 87 HTTP transactions. The main IP is 104.111.230.77, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is login.newscorpaustralia.com. The Cisco Umbrella rank of the primary domain is 138372.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on November 11th 2021. Valid for: a year.

This is the only time login.newscorpaustralia.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 11	104.111.230.77 104.111.230.77	16625 (AKAMAI-AS) (AKAMAI-AS)
21	161.71.21.33 161.71.21.33	14340 (SALESFORCE) (SALESFORCE)
1	151.101.65.175 151.101.65.175	54113 (FASTLY) (FASTLY)
8	13.237.244.18 13.237.244.18	16509 (AMAZON-02) (AMAZON-02)
3	13.226.145.82 13.226.145.82	16509 (AMAZON-02) (AMAZON-02)
2	13.226.158.58 13.226.158.58	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
2	2.18.232.232 2.18.232.232	16625 (AKAMAI-AS) (AKAMAI-AS)
3	13.226.145.105 13.226.145.105	16509 (AMAZON-02) (AMAZON-02)
3	2.18.233.169 2.18.233.169	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
13	54.194.75.122 54.194.75.122	16509 (AMAZON-02) (AMAZON-02)
1	63.35.20.93 63.35.20.93	16509 (AMAZON-02) (AMAZON-02)
2	15.188.95.229 15.188.95.229	16509 (AMAZON-02) (AMAZON-02)
1 1	52.50.18.68 52.50.18.68	16509 (AMAZON-02) (AMAZON-02)
2 3	37.252.172.123 37.252.172.123	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	2001:678:cb4:... 2001:678:cb4:bbbb::13	56396 (AMOBEE) (AMOBEE)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
2 3	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
2 2	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1 1	104.108.144.214 104.108.144.214	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	104.108.145.8 104.108.145.8	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	199.127.207.184 199.127.207.184	26120 (RHYTHMONE) (RHYTHMONE)
1 1	3.125.70.222 3.125.70.222	16509 (AMAZON-02) (AMAZON-02)
1 1	34.226.104.236 34.226.104.236	14618 (AMAZON-AES) (AMAZON-AES)
1	52.51.37.201 52.51.37.201	16509 (AMAZON-02) (AMAZON-02)
1 1	104.92.72.137 104.92.72.137	16625 (AKAMAI-AS) (AKAMAI-AS)
8 8	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
1	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a04:4e42::300 2a04:4e42::300	54113 (FASTLY) (FASTLY)
3 3	213.19.147.44 213.19.147.44	26120 (RHYTHMONE) (RHYTHMONE)
87	26

11 104.111.230.77 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-230-77.deploy.static.akamaitechnologies.com

myaccount.news.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
login.newscorpaustralia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 161.71.21.33 (London, United Kingdom)

ASN14340 (SALESFORCE, US)
PTR: lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

myaccount.heraldsun.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.175 (United States)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.237.244.18 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-237-244-18.ap-southeast-2.compute.amazonaws.com

apps.mypurecloud.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.226.145.82 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-145-82.dus51.r.cloudfront.net

api-cdn.mypurecloud.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.mypurecloud.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.226.158.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-158-58.dus51.r.cloudfront.net

cdn.auth0.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.232.232 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-232.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.226.145.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-145-105.dus51.r.cloudfront.net

subscriptions.news.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.233.169 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-169.deploy.static.akamaitechnologies.com

resourcesssl.newscdn.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tags.news.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 54.194.75.122 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.35.20.93 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-20-93.eu-west-1.compute.amazonaws.com

newscorpau.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.95.229 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

newscorpau.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.50.18.68 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-18-68.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.172.123 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::13 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

d.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.130 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.197.193.217 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.108.144.214 (Berlin, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-144-214.deploy.static.akamaitechnologies.com

image5.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.108.145.8 (Berlin, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-145-8.deploy.static.akamaitechnologies.com

ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.127.207.184 (United States) 1 redirects

ASN26120 (RHYTHMONE, US)

dt.scanscout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.125.70.222 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.226.104.236 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-226-104-236.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.51.37.201 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-37-201.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.92.72.137 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-92-72-137.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.66.49 (United States) 8 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Amsterdam, Netherlands) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::300 (United States)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 213.19.147.44 (United Kingdom) 3 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	heraldsun.com.au myaccount.heraldsun.com.au	2 MB
14	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 184 newscorpau.demdex.net — Cisco Umbrella Rank: 90240	18 KB
11	mypurecloud.com.au apps.mypurecloud.com.au — Cisco Umbrella Rank: 419022 api-cdn.mypurecloud.com.au api.mypurecloud.com.au — Cisco Umbrella Rank: 637075	191 KB
10	newscorpaustralia.com 1 redirects login.newscorpaustralia.com — Cisco Umbrella Rank: 138372	58 KB
9	everesttech.net 9 redirects cm.everesttech.net — Cisco Umbrella Rank: 878 sync-tm.everesttech.net — Cisco Umbrella Rank: 490	2 KB
6	news.com.au 1 redirects myaccount.news.com.au subscriptions.news.com.au — Cisco Umbrella Rank: 666282 tags.news.com.au — Cisco Umbrella Rank: 56186	255 KB
3	casalemedia.com 2 redirects ssum.casalemedia.com — Cisco Umbrella Rank: 1229 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 496	3 KB
3	doubleclick.net 2 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 176	1 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 205	3 KB
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 491	891 B
2	spotxchange.com 1 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 480	1 KB
2	krxd.net 1 redirects usermatch.krxd.net — Cisco Umbrella Rank: 975 beacon.krxd.net — Cisco Umbrella Rank: 375	528 B
2	pubmatic.com 1 redirects image5.pubmatic.com — Cisco Umbrella Rank: 27233 image2.pubmatic.com — Cisco Umbrella Rank: 774	898 B
2	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 293	933 B
2	rubiconproject.com token.rubiconproject.com — Cisco Umbrella Rank: 595 pixel.rubiconproject.com — Cisco Umbrella Rank: 289	453 B
2	omtrdc.net newscorpau.sc.omtrdc.net — Cisco Umbrella Rank: 246023	547 B
2	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 918	9 KB
2	auth0.com cdn.auth0.com — Cisco Umbrella Rank: 9372	238 KB
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 829	475 B
1	taboola.com trc.taboola.com — Cisco Umbrella Rank: 562	231 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 96	605 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 323	274 B
1	bluekai.com 1 redirects tags.bluekai.com — Cisco Umbrella Rank: 404	713 B
1	eyeota.net 1 redirects ps.eyeota.net — Cisco Umbrella Rank: 899	418 B
1	scanscout.com 1 redirects dt.scanscout.com — Cisco Umbrella Rank: 22185	698 B
1	turn.com 1 redirects d.turn.com — Cisco Umbrella Rank: 652	402 B
1	gstatic.com www.gstatic.com	143 KB
1	newscdn.com.au resourcesssl.newscdn.com.au — Cisco Umbrella Rank: 85505	9 KB
1	google.com www.google.com — Cisco Umbrella Rank: 2	967 B
1	kampyle.com nebula-cdn.kampyle.com — Cisco Umbrella Rank: 3348	1 KB
87	30

	Domain	Requested by
21	myaccount.heraldsun.com.au	myaccount.heraldsun.com.au
13	dpm.demdex.net	tags.news.com.au
10	login.newscorpaustralia.com	1 redirects myaccount.heraldsun.com.au login.newscorpaustralia.com cdn.auth0.com
8	sync-tm.everesttech.net	8 redirects
8	apps.mypurecloud.com.au	myaccount.heraldsun.com.au apps.mypurecloud.com.au
3	cm.g.doubleclick.net	2 redirects
3	ib.adnxs.com	2 redirects
3	subscriptions.news.com.au	login.newscorpaustralia.com
2	sync.1rx.io	2 redirects
2	sync.search.spotxchange.com	1 redirects
2	ssum.casalemedia.com	2 redirects
2	match.adsrvr.org	2 redirects
2	newscorpau.sc.omtrdc.net	tags.news.com.au
2	tags.news.com.au	tags.tiqcdn.com
2	tags.tiqcdn.com	login.newscorpaustralia.com tags.tiqcdn.com
2	cdn.auth0.com	login.newscorpaustralia.com cdn.auth0.com
2	api-cdn.mypurecloud.com.au	apps.mypurecloud.com.au
1	sync.targeting.unrulymedia.com	1 redirects
1	trc.taboola.com
1	www.facebook.com
1	image2.pubmatic.com
1	us-u.openx.net
1	dsum-sec.casalemedia.com
1	pixel.rubiconproject.com
1	tags.bluekai.com	1 redirects
1	beacon.krxd.net
1	usermatch.krxd.net	1 redirects
1	ps.eyeota.net	1 redirects
1	dt.scanscout.com	1 redirects
1	image5.pubmatic.com	1 redirects
1	token.rubiconproject.com
1	d.turn.com	1 redirects
1	cm.everesttech.net	1 redirects
1	newscorpau.demdex.net	tags.news.com.au
1	www.gstatic.com	www.google.com
1	resourcesssl.newscdn.com.au	login.newscorpaustralia.com
1	www.google.com	login.newscorpaustralia.com
1	api.mypurecloud.com.au	apps.mypurecloud.com.au
1	nebula-cdn.kampyle.com	myaccount.heraldsun.com.au
1	myaccount.news.com.au	1 redirects
87	40

This site contains links to these domains. Also see Links.

Domain
www.heraldsun.com.au

Subject Issuer	Validity	Valid
myaccount.heraldsun.com.au Trusted Secure Certificate Authority 5	`2021-05-31` - `2022-06-22`	a year	crt.sh
*.kampyle.com GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-02-22` - `2023-03-26`	a year	crt.sh
mypurecloud.com.au Amazon	`2021-10-21` - `2022-11-19`	a year	crt.sh
news.com.au DigiCert SHA2 Secure Server CA	`2021-11-11` - `2022-11-11`	a year	crt.sh
*.auth0.com Amazon	`2021-04-25` - `2022-05-24`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
subscriptions.news.com.au Amazon	`2021-04-07` - `2022-05-06`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
*.sc.omtrdc.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-02-17` - `2023-03-07`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-28` - `2022-12-29`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Frame ID: D5B3431A244C89816BA676ED161C511C
Requests: 64 HTTP requests in this frame

Frame: https://apps.mypurecloud.com.au/messenger/messenger.html
Frame ID: A65F517EA74CA08A12C1C2E5E9EB5AEB
Requests: 7 HTTP requests in this frame

Frame: https://newscorpau.demdex.net/dest5.html?d_nsid=0
Frame ID: F6DA978B02003CCC58968E8A857E995C
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in

Page URL History Show full URLs

https://myaccount.news.com.au/heraldsun/viewAccount?cid=19021054 HTTP 301
https://myaccount.heraldsun.com.au/s/?cid=19021054 Page URL
https://login.newscorpaustralia.com/samlp/AnudjFSZnp48OLKBaaB382z4LHeAfIS5?prevent_sign_up=true&prompt=none&site... HTTP 302
https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3Rp... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Auth0 Lock (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/lock/([\d.]+)/lock(?:.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Genesys Cloud (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

apps\.mypurecloud\.\w+

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

87
Requests

70 %
HTTPS

14 %
IPv6

30
Domains

40
Subdomains

26
IPs

7
Countries

2531 kB
Transfer

11434 kB
Size

54
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.heraldsun.com.au/subscribe/news/1/?offerset=hs_default&sourceCode=HSWEB_ONS596
Title: Subscribe now

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://myaccount.news.com.au/heraldsun/viewAccount?cid=19021054 HTTP 301
https://myaccount.heraldsun.com.au/s/?cid=19021054 Page URL
https://login.newscorpaustralia.com/samlp/AnudjFSZnp48OLKBaaB382z4LHeAfIS5?prevent_sign_up=true&prompt=none&site=heraldsun HTTP 302
https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://myaccount.news.com.au/heraldsun/viewAccount?cid=19021054 HTTP 301
https://myaccount.heraldsun.com.au/s/?cid=19021054

Request Chain 67

https://cm.everesttech.net/cm/dd?d_uuid=59621068440847191071182778776105486003 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YjT0pgAAAIUE6gQS

Request Chain 70

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP 302
https://dpm.demdex.net/ibs:dpid=358&dpuuid=6345117155756232103

Request Chain 71

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjM2NTYzMjkvdC8y/url/https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D470%26dpuuid%3D%24!%7BTURN_UUID%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=470&dpuuid=2422800323313849989

Request Chain 74

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NTk2MjEwNjg0NDA4NDcxOTEwNzExODI3Nzg3NzYxMDU0ODYwMDM= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NTk2MjEwNjg0NDA4NDcxOTEwNzExODI3Nzg3NzYxMDU0ODYwMDM=&google_tc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEPP728TvDKPCQAiCu0OMZUI&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 75

https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=34e3611a-6475-47a7-b2ce-538b2af8c104

Request Chain 76

https://image5.pubmatic.com/AdServer/usersync/usersync.html?predirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=19566%26dpuuid=PM_UID&userIdMacro=PM_UID HTTP 302
https://dpm.demdex.net/ibs:dpid=19566&dpuuid=%s

Request Chain 77

https://ssum.casalemedia.com/usermatchredir?s=183607&cb=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D23728%26dpuuid%3D__UID__ HTTP 302
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D23728%26dpuuid%3D__UID__&s=183607&C=1 HTTP 302
https://dpm.demdex.net/ibs:dpid=23728&dpuuid=YjT0p1KyqawYzPFdWN41fQAA%261195

Request Chain 78

https://dt.scanscout.com/ssframework/uid?UIAA=59621068440847191071182778776105486003&url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30432%26dpuuid%3D%5BUSER_ID%5D HTTP 302
https://dpm.demdex.net/ibs:dpid=30432&dpuuid=CI-e6ad6b5d8487c455159c644bbe718898

Request Chain 79

https://ps.eyeota.net/match?bid=6j5b2cv&uid=59621068440847191071182778776105486003&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

Request Chain 80

https://usermatch.krxd.net/um/v2?partner=adobe&id=59621068440847191071182778776105486003 HTTP 302
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=59621068440847191071182778776105486003

Request Chain 81

https://tags.bluekai.com/site/43981?id=59621068440847191071182778776105486003&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D134096%26dpuuid%3D%24_BK_UUID HTTP 302
https://dpm.demdex.net/ibs:dpid=134096&dpuuid=$_BK_UUID

Request Chain 82

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WWpUMHBnQUFBSVVFNmdRUw==

Request Chain 83

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YjT0pgAAAIUE6gQS&expires=90

Request Chain 84

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YjT0pgAAAIUE6gQS

Request Chain 85

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=YjT0pgAAAIUE6gQS

Request Chain 86

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YjT0pgAAAIUE6gQS

Request Chain 87

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YjT0pgAAAIUE6gQS

Request Chain 88

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YjT0pgAAAIUE6gQS&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YjT0pgAAAIUE6gQS&img=1&__user_check__=1&sync_id=79899548-a6ff-11ec-844c-19da87bf0506

Request Chain 89

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YjT0pgAAAIUE6gQS&t=2592000&o=0

Request Chain 91

https://sync.1rx.io/usersync/adobe/0?dspret=1&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D461447%26dpuuid%3D%5BRX_UUID%5D HTTP 302
https://sync.1rx.io/usersync/adobe/0?zcc=1&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D461447%26dpuuid%3D%5BRX_UUID%5D&cb=1647637673050 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D461447%26dpuuid%3DRX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003 HTTP 302
https://dpm.demdex.net/ibs:dpid=461447&dpuuid=RX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003

87 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
myaccount.heraldsun.com.au/s/
Redirect Chain

https://myaccount.news.com.au/heraldsun/viewAccount?cid=19021054
https://myaccount.heraldsun.com.au/s/?cid=19021054

147 KB
32 KB

512ms
399ms

Document
text/html

161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/?cid=19021054

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

d2be23ec79b6f7809a6e75740a286ca995bc625d0d79c4a39465ff5ac702d428

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests frame-ancestors *
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 18 Mar 2022 21:07:45 GMT
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Strict-Transport-Security: max-age=63072004; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: upgrade-insecure-requests frame-ancestors *
Referrer-Policy: origin-when-cross-origin
Expires: Thu, 18 Mar 2021 21:07:45 GMT
Content-Type: text/html;charset=UTF-8
Vary: Origin, Accept-Encoding
Last-Modified: Thu, 18 Mar 2021 21:07:45 GMT
Link: </s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js>;rel=preload;as=script;nopush,</s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22serializationVersion%22%3A%221-2.5.13-236.1-b%22%2C%22parts%22%3A%22f%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%22KbCmDBVbE10iCy1inwbbzA%22%7D%2C%22dns%22%3A%22c%22%2C%22ls%22%3A1%2C%22lrmc%22%3A%221730203071%22%7D/app.js>;rel=preload;as=script;nopush
X-FRAME-OPTIONS: ALLOWALL
Server-Timing: Total;dur=121
Timing-Allow-Origin: *
Content-Encoding: gzip
Transfer-Encoding: chunked

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://myaccount.heraldsun.com.au/s/?cid=19021054
Date: Fri, 18 Mar 2022 21:07:45 GMT
Connection: keep-alive
Vary: User-Agent

GET
H/1.1 200
OK aura_prod.js Show response
myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/ 756 KB
240 KB 337ms
336ms Script
text/javascript 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

b3c0f4c313dd0b10df279781dc24c220d193e2837630255b77a44bd637a8f07c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:46 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 17 Mar 2022 21:07:46 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Server-Timing
Cache-Control: max-age=31536000,public,immutable
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Server-Timing: Total;dur=31
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK app.js Show response
myaccount.heraldsun.com.au/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22serializationVersion%22%3A%221-2.5.13-236.1-b%22%2C%22parts%22%3A%22f%22%2C%22loa... 2 MB
447 KB 86ms
22ms Script
text/javascript 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22serializationVersion%22%3A%221-2.5.13-236.1-b%22%2C%22parts%22%3A%22f%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%22KbCmDBVbE10iCy1inwbbzA%22%7D%2C%22dns%22%3A%22c%22%2C%22ls%22%3A1%2C%22lrmc%22%3A%221730203071%22%7D/app.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

b5a303d862a4eb33617dd49ff66b7765dcda2409dbe02e2953f74f21518160c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:06:35 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 17 Mar 2022 21:06:35 GMT
Age: 71
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000,public,immutable
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Content-Length: 457106
X-XSS-Protection: 1; mode=block

GET
H2 200 embed.js Show response
nebula-cdn.kampyle.com/au/wau/132224/onsite/ 2 KB
1 KB 31ms
7ms Script
application/javascript 151.101.65.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://nebula-cdn.kampyle.com/au/wau/132224/onsite/embed.js
Requested by: Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/?cid=19021054
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.175 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d663fa330e3cf99b125309270bffaed504c5c487a1118d4ba5265c939dcf4cfa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id: 0bzTWWNOq.7kAOVMmXrErAxfJ.GZwBXg
content-encoding: gzip
etag: "09fc790a422dc87e5812fd7794deb093"
age: 161554
via: 1.1 varnish
x-cache: HIT
content-length: 665
x-amz-id-2: bo5vAheuym1JWbNURT41QR3DT7SiUcuWHd0BvV4EgnbjAK0fwhLNlGocihX5z8BPmiAkgERX3uQ=
x-served-by: cache-hhn4070-HHN
last-modified: Mon, 28 Feb 2022 12:24:11 GMT
server: AmazonS3
x-timer: S1647637666.042862,VS0,VE1
date: Fri, 18 Mar 2022 21:07:46 GMT
vary: Accept-Encoding
x-amz-request-id: X9AH8PNGG2V0BVF5
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 genesys.min.js Show response
apps.mypurecloud.com.au/genesys-bootstrap/ 101 KB
29 KB 1118ms
545ms Script
text/javascript 13.237.244.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com.au/genesys-bootstrap/genesys.min.js

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/?cid=19021054

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.237.244.18 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-237-244-18.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

6344c0b525bece86162de68ac33971b6453f5074fcaa0278f7f2443b2d334872

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:46 GMT
content-encoding: gzip
last-modified: Wed, 16 Mar 2022 16:00:29 GMT
server: nginx
x-amz-request-id: GMBANGNQ2JTBHWSM
etag: "6e7e69b8bb4bee25ec21168b1b373341"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 29690
x-amz-version-id: Sop.AajJ1kgjkc8FUTsHDQJ9__QoXTi.
x-amz-id-2: jfllf/V7+PV946KT+8fIbGjVqCd36QAouGYIlorhZrCtBIC7DgriLfUQcIWzlT4+cR3e98ppZm0=

GET
H/1.1 200
OK fonts.css
myaccount.heraldsun.com.au/s/sfsites/runtimedownload/ 0
500 B 295ms
276ms Stylesheet
text/css 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/runtimedownload/fonts.css?lastMod=1625040930000&brandSet=923c573b-a87e-4e95-8b8b-21ccb9007df9

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/?cid=19021054

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:46 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Wed, 30 Jun 2021 08:15:30 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: text/css; charset=utf-8
Cache-Control: public,max-age=31536000
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Expires: Sat, 18 Mar 2023 21:07:46 GMT

GET
H/1.1 200
OK app.css
myaccount.heraldsun.com.au/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%22K... 979 KB
121 KB 553ms
553ms Stylesheet
text/css 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%22KbCmDBVbE10iCy1inwbbzA%22%7D%2C%22styleContext%22%3A%7B%22c%22%3A%22webkit%22%2C%22x%22%3A%5B%22isDesktop%22%5D%2C%22tokens%22%3A%5B%22markup%3A%2F%2Fsiteforce%3AserializedTokens%22%2C%22markup%3A%2F%2Fforce%3AsldsTokens%22%2C%22markup%3A%2F%2Fsiteforce%3AcommunityTokens%22%2C%22markup%3A%2F%2Fforce%3AformFactorLarge%22%2C%22markup%3A%2F%2Fsiteforce%3AcommunityFormFactorLarge%22%2C%22markup%3A%2F%2Fsiteforce%3AauraDynamicTokens%22%2C%22markup%3A%2F%2Fsiteforce%3AsldsFontOverride%22%5D%2C%22tuid%22%3A%22-QYc9dnCpwLLjfBdPVBs3A%22%2C%22cuid%22%3A525911965%7D%2C%22pathPrefix%22%3A%22%22%7D/app.css?aura.attributes=%7B%22schema%22%3A%22Published%22%2C%22brandingSetId%22%3A%22923c573b-a87e-4e95-8b8b-21ccb9007df9%22%2C%22authenticated%22%3A%22false%22%2C%22ac%22%3A%22%22%2C%22formFactor%22%3A%22LARGE%22%2C%22publishedChangelistNum%22%3A%22101%22%2C%22viewType%22%3A%22Published%22%2C%22themeLayoutType%22%3A%22khJA7v6OAwrD3vF1z0Hp919YwZ9w4D%22%2C%22language%22%3A%22en_US%22%2C%22isHybrid%22%3A%22false%22%2C%22pageId%22%3A%22ab0d424b-4062-47c9-95f8-07c3383e5d37%22%7D&2

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/?cid=19021054

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

c73e9313bb8d3f3b1a7ce0e6fe28d8f4ecff121601d48351c206159c7c252d72

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:46 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 17 Mar 2022 21:07:46 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000,public,immutable
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK resources.js Show response
myaccount.heraldsun.com.au/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22fwuid%22%3A%22hXQ6H-x_YQB1RZ2gyQB4Mg%22%2C%22loaded%22%3A%7B%22APPLICATION%40mark... 15 KB
5 KB 357ms
356ms Script
text/javascript 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/?cid=19021054

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

dad84ffd0d9253b611114948f27e23fcc0022cd9f1b7ca46820459c2b7d7ddbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:46 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 17 Mar 2022 21:07:46 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000,private,immutable
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bootstrap.js Show response
myaccount.heraldsun.com.au/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22fwuid%22%3A%22hXQ6H-x_YQB1RZ2gyQB4Mg%22%2C%22loaded%22%3A%7B%22APPLICATION%40mark... 875 KB
144 KB 520ms
520ms Script
text/javascript 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22fwuid%22%3A%22hXQ6H-x_YQB1RZ2gyQB4Mg%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%22KbCmDBVbE10iCy1inwbbzA%22%7D%2C%22apce%22%3A1%2C%22apck%22%3A%22Aedtip6HqiQQsa93SL0dtg%22%2C%22mlr%22%3A1%2C%22pathPrefix%22%3A%22%22%2C%22dns%22%3A%22c%22%2C%22ls%22%3A1%2C%22lrmc%22%3A%221730203071%22%7D/bootstrap.js?aura.attributes=%7B%22schema%22%3A%22Published%22%2C%22brandingSetId%22%3A%22923c573b-a87e-4e95-8b8b-21ccb9007df9%22%2C%22authenticated%22%3A%22false%22%2C%22ac%22%3A%22%22%2C%22formFactor%22%3A%22LARGE%22%2C%22publishedChangelistNum%22%3A%22101%22%2C%22viewType%22%3A%22Published%22%2C%22themeLayoutType%22%3A%22khJA7v6OAwrD3vF1z0Hp919YwZ9w4D%22%2C%22language%22%3A%22en_US%22%2C%22isHybrid%22%3A%22false%22%2C%22pageId%22%3A%22ab0d424b-4062-47c9-95f8-07c3383e5d37%22%7D

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/?cid=19021054

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

7949daef6d7c603e673dc01dd76282fcd2abf3fd81cea2cd6bfb0a5e1a64e29d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:46 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 17 Mar 2022 21:07:46 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=900,public
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK domains.json Show response
api-cdn.mypurecloud.com.au/webdeployments/v1/deployments/87ae5cf9-ac9f-4c77-9af4-5ba03da2e5fd/ 596 B
1 KB 63ms
25ms XHR
application/json 13.226.145.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-cdn.mypurecloud.com.au/webdeployments/v1/deployments/87ae5cf9-ac9f-4c77-9af4-5ba03da2e5fd/domains.json
Requested by: Host: apps.mypurecloud.com.au
URL: https://apps.mypurecloud.com.au/genesys-bootstrap/genesys.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.145.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-145-82.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 874437e27e97a86da894c33508123bacba74c260e211d3bea4f13c3f46033db9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:06:38 GMT
Via: 1.1 bfd667b9fb826986b85315f856bf5884.cloudfront.net (CloudFront)
Age: 70
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 596
Last-Modified: Thu, 03 Mar 2022 04:52:56 GMT
Server: AmazonS3
ETag: "a795c2a118d04c56b07d8e399c6dd684"
Vary: Origin
Access-Control-Allow-Methods: GET, POST, PUT
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: max-age=120,s-maxage=120
X-Amz-Cf-Pop: DUS51-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: e-UD0UDwNkimciu1ec4USolhtBln21wu9cKJpcVG2GWvQAc5nWGcrA==

GET
H/1.1 200
OK config.json Show response
api-cdn.mypurecloud.com.au/webdeployments/v1/deployments/87ae5cf9-ac9f-4c77-9af4-5ba03da2e5fd/ 495 B
1 KB 26ms
25ms XHR
application/json 13.226.145.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-cdn.mypurecloud.com.au/webdeployments/v1/deployments/87ae5cf9-ac9f-4c77-9af4-5ba03da2e5fd/config.json
Requested by: Host: apps.mypurecloud.com.au
URL: https://apps.mypurecloud.com.au/genesys-bootstrap/genesys.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.145.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-145-82.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d582d3d255eaba52698b1b862401f3edd8da782729b9945b177fc47c7055132f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:06:39 GMT
Via: 1.1 bfd667b9fb826986b85315f856bf5884.cloudfront.net (CloudFront)
Age: 69
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 495
Last-Modified: Thu, 03 Mar 2022 04:52:55 GMT
Server: AmazonS3
ETag: "fd1aa5fab91be008ad87afcc5b1f7ed5"
Vary: Origin
Access-Control-Allow-Methods: GET, POST, PUT
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: max-age=120,s-maxage=120
X-Amz-Cf-Pop: DUS51-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: wj9YXMn3GkSXi6mTjUyQGBK7cFs9QC3kcDSTJb2m_3aWmr1hVMZfng==

GET
H2 200 journey.min.js Show response
apps.mypurecloud.com.au/journey/messenger-plugins/ 99 KB
30 KB 273ms
273ms Script
text/javascript 13.237.244.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com.au/journey/messenger-plugins/journey.min.js

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.237.244.18 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-237-244-18.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

d9094da13005a9d8089ee8514adf9eb0398a8c952b86c49a446c0e1d57f65e5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:47 GMT
content-encoding: gzip
last-modified: Tue, 15 Feb 2022 09:17:06 GMT
server: nginx
x-amz-request-id: C74J9VXDTPSBKB9C
etag: "91b903ad01da6d593869dac5c08eb25f"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age: 600
content-length: 30208
x-amz-version-id: 4UQengBHm5kuebSQ2KxLIONO0mGZcrgw
x-amz-id-2: bNqFKcTq5gskOLJqfzge2qWjYLHx6lNAYX/QQMhSCd2vVZrSrDR5/mBJrojUHsOO7eudwRIRD+w=

GET
H2 200 offersHelper.min.js Show response
apps.mypurecloud.com.au/journey/messenger-plugins/ 12 KB
5 KB 703ms
703ms Script
text/javascript 13.237.244.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com.au/journey/messenger-plugins/offersHelper.min.js

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.237.244.18 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-237-244-18.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

a63540aa2a97c549fe93e0aac747a34467cd51b2fb36c4d10c4a318eff39c213

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:47 GMT
content-encoding: gzip
last-modified: Tue, 15 Feb 2022 09:17:06 GMT
server: nginx
x-amz-request-id: Y137JH6RZMJ91094
etag: "04d6c67b48de821b287d684a6aa25a24"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age: 600
content-length: 5068
x-amz-version-id: IlnTTte4tzJPxUQ8_AKdID_COX1JeIvS
x-amz-id-2: 8he1+kop03ZrOo/7mU+VRKWYxYynuDc7GcpFvhdlZbMkWTlgprwQbDfrpJhaTs1+vTD/8rupi4Q=

GET
H2 200 messenger.html Show response
apps.mypurecloud.com.au/messenger/ Frame A65F 1 KB
950 B 709ms
708ms Document
text/html 13.237.244.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com.au/messenger/messenger.html

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.237.244.18 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-237-244-18.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

83735bbc6ef3247fa656770e5ba56b2732b1d019c43be56b3a26759d3f1ae663

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/

Response headers

date: Fri, 18 Mar 2022 21:07:47 GMT
content-type: text/html
server: nginx
x-amz-id-2: yCCnMDIupFIg86J4+HcVgrK9Gt/SI3yGyIRYwp3xHJwW+dKx8kBZrR0+k5f+CtRIZ8ZKJUPIolw=
x-amz-request-id: Y131ERXNR1SRF8GP
cache-control: max-age=0, no-cache
last-modified: Wed, 16 Mar 2022 16:07:30 GMT
x-amz-version-id: cNB2v4QQO5x1aLjzYYRpY.VTXpCOJKlT
etag: W/"c8a5a6ef9e7d04e04e71e9cba9b98aa3"
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: gzip

GET
H/1.1 200
OK aura Show response
myaccount.heraldsun.com.au/s/sfsites/ 4 MB
373 KB 847ms
846ms XHR
application/json 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/aura?message=%7B%22actions%22%3A%5B%7B%22descriptor%22%3A%22serviceComponent%3A%2F%2Fui.comm.runtime.components.aura.components.siteforce.controller.PubliclyCacheableComponentLoaderController%2FACTION%24getPageComponent%22%2C%22callingDescriptor%22%3A%22UNKNOWN%22%2C%22params%22%3A%7B%22attributes%22%3A%7B%22viewId%22%3A%221f33d2a3-3335-4f5a-8bcb-bde61d4aaf0f%22%2C%22routeType%22%3A%22home%22%2C%22themeLayoutType%22%3A%22khJA7v6OAwrD3vF1z0Hp919YwZ9w4D%22%2C%22params%22%3A%7B%22cid%22%3A%22%22%2C%22viewid%22%3A%2205e883c0-4822-4cf4-b497-33446785a989%22%2C%22view_uddid%22%3A%22%22%2C%22entity_name%22%3A%22%22%2C%22audience_name%22%3A%22%22%2C%22picasso_id%22%3A%22%22%2C%22routeId%22%3A%22%22%7D%2C%22hasAttrVaringCmps%22%3Afalse%2C%22pageLoadType%22%3A%22STANDARD_PAGE_CONTENT%22%2C%22includeLayout%22%3Atrue%2C%22priority%22%3A%220%22%7D%2C%22publishedChangelistNum%22%3A101%2C%22brandingSetId%22%3A%22923c573b-a87e-4e95-8b8b-21ccb9007df9%22%7D%7D%5D%7D&aura.context=%7B%22mode%22%3A%22PROD%22%2C%22fwuid%22%3A%22hXQ6H-x_YQB1RZ2gyQB4Mg%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%22KbCmDBVbE10iCy1inwbbzA%22%7D%2C%22apck%22%3A%22Aedtip6HqiQQsa93SL0dtg%22%2C%22uad%22%3Afalse%7D&aura.isAction=true

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

843ae6433eab44ef701a6a5979fb1c816173bb104242c11a186fa092bbac856f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
Accept-Language: de-DE,de;q=0.9
X-SFDC-Page-Scope-Id: 712ba212-af01-4e20-a153-678c168bdf41
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:47 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 17 Mar 2022 21:07:47 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=1800,public
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Expires: Thu, 18 Mar 2021 21:07:47 GMT

GET
H/1.1 404
Not Found all.css
myaccount.heraldsun.com.au/resource/1625040237000/NewsCorpAssets/NewsCorpAssets/fontawesome5/css/ 0
0 294ms
294ms Stylesheet
text/html 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/resource/1625040237000/NewsCorpAssets/NewsCorpAssets/fontawesome5/css/all.css

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072004; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:47 GMT
Content-Security-Policy-Report-Only: default-src https:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; img-src https: data: blob: file:; frame-ancestors 'self' *.salesforce.com *.force.com *.visualforce.com *.documentforce.com; font-src https: data: blob: file:; connect-src 'self' https:; report-uri https://csp-report.force.com/_/ContentDomainCSPNoAuth?type=communities
P3P: CP="CUR OTR STA"
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Transfer-Encoding: chunked
Content-Security-Policy: upgrade-insecure-requests
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: text/html; charset=UTF-8
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 404
Not Found newsCorpCustomCSS.css
myaccount.heraldsun.com.au/resource/1625040237000/NewsCorpAssets/NewsCorpAssets/ 0
0 280ms
279ms Stylesheet
text/html 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/resource/1625040237000/NewsCorpAssets/NewsCorpAssets/newsCorpCustomCSS.css

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072004; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:47 GMT
Transfer-Encoding: chunked
P3P: CP="CUR OTR STA"
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Content-Security-Policy: upgrade-insecure-requests
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: text/html; charset=UTF-8
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK TimesClassicDisplay.woff
myaccount.heraldsun.com.au/resource/TimesClassic/ 25 KB
25 KB 330ms
289ms Font
application/octet-stream 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/resource/TimesClassic/TimesClassicDisplay.woff

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/?cid=19021054

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

378bccecf18292dcd22d7079658a59dc3bc05652597e770846b9e8665c996f2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains

Request headers

Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
Origin: https://myaccount.heraldsun.com.au
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:47 GMT
Last-Modified: Sat, 6 Jul 2019 05:13:57 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
P3P: CP="CUR OTR STA"
Cache-Control: public,max-age=3888000
Content-Type: application/octet-stream
Content-Length: 25640
Expires: Mon, 02 May 2022 21:07:47 GMT

GET
H/1.1 200
OK Roboto-Regular.ttf
myaccount.heraldsun.com.au/resource/Roboto/ 167 KB
167 KB 324ms
282ms Font
application/octet-stream 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/resource/Roboto/Roboto-Regular.ttf

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/?cid=19021054

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

9e79eaebefe9cb1188defba9413ad6d383cff1f0b4334f0b878634648fb70322

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains

Request headers

Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
Origin: https://myaccount.heraldsun.com.au
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:47 GMT
Last-Modified: Sat, 6 Jul 2019 05:13:57 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
P3P: CP="CUR OTR STA"
Cache-Control: public,max-age=3888000
Content-Type: application/octet-stream
Content-Length: 170984
Expires: Mon, 02 May 2022 21:07:47 GMT

POST
H/1.1 200
OK aura
myaccount.heraldsun.com.au/s/sfsites/ 123 KB
34 KB 787ms
745ms XHR
application/json 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/aura?r=1&aura.Component.getComponent=1&other.MyAcc_ContentFooter.getFooterDisplay=2&other.MyAcc_ContentFooter.getFooterDisplayLogo=2&other.MyAcc_ContentFooter.getFooterDisplayText=2&other.MyAcc_ContentFooter.getProfileName=2&other.MyAcc_ContentFooter.getsrcLogo=1&other.MyAcc_CustomProfileMenu.getFirstLastName=1&other.MyAcc_CustomProfileMenu.getProfileIconDisplay=1&other.MyAcc_CustomProfileMenu.getURL=1&other.MyAcc_CustomProfileMenu.getUserProfile=1&other.MyAcc_ThemedLayout.getBrandingName=4&other.MyAcc_ThemedLayout.getLoginUrl=1&other.MyAcc_ThemedLayout.getUserProfileName=1&other.MyAcc_ThemedLayout.getsrcLogo=1&other.MyAcc_ThemedLayout.setupEnvironment=1&ui-communities-components-aura-components-forceCommunity-navigationMenu.NavigationMenuDataProvider.getNavigationMenu=1&ui-force-components-controllers-hostConfig.HostConfig.getConfigData=1

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
X-SFDC-Page-Cache: 3de09bb33c6ab9f5
Accept-Language: de-DE,de;q=0.9
X-SFDC-Page-Scope-Id: 712ba212-af01-4e20-a153-678c168bdf41
X-SFDC-Request-Id: 22931000006280e45b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Fri, 18 Mar 2022 21:07:47 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 18 Mar 2021 21:07:47 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: application/json;charset=UTF-8
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Server-Timing: Total;dur=417
Timing-Allow-Origin: *
Vary: Origin, Accept-Encoding
X-XSS-Protection: 1; mode=block
Expires: Thu, 18 Mar 2021 21:07:47 GMT

POST
H/1.1 204
No Content beacons
api.mypurecloud.com.au/api/v2/journey/deployments/87ae5cf9-ac9f-4c77-9af4-5ba03da2e5fd/customers/112a2f49-751c-4cd6-90a2-db806b35a04b/ 0
846 B 923ms
856ms Ping
text/plain 13.226.145.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.mypurecloud.com.au/api/v2/journey/deployments/87ae5cf9-ac9f-4c77-9af4-5ba03da2e5fd/customers/112a2f49-751c-4cd6-90a2-db806b35a04b/beacons?data=eyJfdiI6IjIuMTAzOC4wIiwiX2FjdG11IjoiMTEyYTJmNDktNzUxYy00Y2Q2LTkwYTItZGI4MDZiMzVhMDRiIiwiYXR0Ijp7fSwiY2lkIjoiMTEyYTJmNDktNzUxYy00Y2Q2LTkwYTItZGI4MDZiMzVhMDRiIiwiY3ZjIjoiMSIsImRrIjpudWxsLCJkbCI6Imh0dHBzOi8vbXlhY2NvdW50LmhlcmFsZHN1bi5jb20uYXUvcy8%2FY2lkPTE5MDIxMDU0IiwiZG4iOiJlbi1VUyIsImR0IjoiSG9tZSIsImZmIjpmYWxzZSwiZmoiOmZhbHNlLCJmcCI6dHJ1ZSwiZnciOnRydWUsInNiYyI6MSwic2giOjEyMDAsInNpZCI6ImQ1NDU5ZWUxLTlmMDEtNDY1ZC1hMGQzLTg2Y2E4NDM4ZWZhZSIsInNwYyI6MSwic3NmIjowLCJzc3AiOjAsInN3IjoxNjAwLCJ0IjoicGFnZXZpZXciLCJ0YmMiOjEsInRwYyI6MSwidHRzIjp7fSwidmgiOjEyMDAsInZ3IjoxNjAwfQ%3D%3D&type=pageview

Requested by

Host: apps.mypurecloud.com.au
URL: https://apps.mypurecloud.com.au/journey/messenger-plugins/journey.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.226.145.82 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-145-82.dus51.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=600; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:48 GMT
Via: 1.1 49e78dae34a1d21beb31b4002f7ce92e.cloudfront.net (CloudFront)
Connection: keep-alive
ININ-Correlation-Id: b6cf0d25-120a-4c7a-a985-9cb7746beeb7
X-Amz-Cf-Pop: DUS51-C1
Strict-Transport-Security: max-age=600; includeSubDomains
X-Cache: Miss from cloudfront
Access-Control-Allow-Origin: https://myaccount.heraldsun.com.au
Access-Control-Expose-Headers: Retry-After,inin-correlation-id
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, DNT, User-Agent, Keep-Alive, Cache-Control, ININ-Client-Path
X-Amz-Cf-Id: Q6WJNupdK7lcN26gM1zxM-Wh-B9hTY4C7MkMLVA5l7b6qtolVe9Cxg==

GET
H2 200 newrelic-agent.js
apps.mypurecloud.com.au/messenger/newrelic/ Frame A65F 28 KB
10 KB 272ms
272ms Script
text/javascript 13.237.244.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com.au/messenger/newrelic/newrelic-agent.js

Requested by

Host: apps.mypurecloud.com.au
URL: https://apps.mypurecloud.com.au/messenger/messenger.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.237.244.18 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-237-244-18.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com.au/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:48 GMT
content-encoding: gzip
last-modified: Wed, 16 Mar 2022 16:07:30 GMT
server: nginx
x-amz-request-id: J0VKV5DH0GAE5H0Q
etag: "c797f019f604b32731472b61d09beed2"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 9923
x-amz-version-id: nyR.qAwM8mfTCyZdHtTDAnUf48Mi7YkO
x-amz-id-2: L23hpcH0o4KZo8Mj+myN8/bkcLjYZ1vnLxqDVmN0bxqDBcRNl2SaPFrk3KTy/70pcFWx0EPMgKc=

POST
H/1.1 200
OK aura
myaccount.heraldsun.com.au/s/sfsites/ 6 KB
2 KB 594ms
593ms XHR
application/json 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/aura?r=2&other.MyAcc_AccountName.getMenu=1&other.MyAcc_AccountName.getMenuDefault=1&other.MyAcc_Base.getProfileInfo=1&other.MyAcc_Base.getUserName=1&other.MyAcc_Content.getMenu=1&other.MyAcc_ContentFooter.getFooterDisplay=1&other.MyAcc_ContentFooter.getFooterDisplayLogo=1&other.MyAcc_ContentFooter.getFooterDisplayText=1&other.MyAcc_ContentFooter.getProfileName=1&other.MyAcc_ContentFooter.getsrcLogo=1&other.MyAcc_ThemedLayout.getBrandingName=4&other.MyAcc_VerticalNav.getMenu=1&other.MyAcc_VerticalNav.getMenuDefault=1&other.MyAcc_VerticalNav.getUserProfile=1&other.MyAcc_VerticalNav.getsrcLogo=1

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
X-SFDC-Page-Cache: 3de09bb33c6ab9f5
Accept-Language: de-DE,de;q=0.9
X-SFDC-Page-Scope-Id: 712ba212-af01-4e20-a153-678c168bdf41
X-SFDC-Request-Id: 30235000009c261ccc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Fri, 18 Mar 2022 21:07:48 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 18 Mar 2021 21:07:48 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: application/json;charset=UTF-8
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Server-Timing: Total;dur=317
Timing-Allow-Origin: *
Vary: Origin, Accept-Encoding
X-XSS-Protection: 1; mode=block
Expires: Thu, 18 Mar 2021 21:07:48 GMT

GET
H2

200

Primary Request login Show response
login.newscorpaustralia.com/
Redirect Chain

https://login.newscorpaustralia.com/samlp/AnudjFSZnp48OLKBaaB382z4LHeAfIS5?prevent_sign_up=true&prompt=none&site=heraldsun
https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgye...

81 KB
21 KB

493ms
493ms

Document
text/html

104.111.230.77
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.230.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-230-77.deploy.static.akamaitechnologies.com

Software

cloudflare /

Resource Hash

88d2450f3e213e8bb288a303367c2172280e33783939254f1f03a57b70065cb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054

Response headers

content-type: text/html; charset=utf-8
cf-ray: 6ee0f0a6a8066955-FRA
etag: W/"14027-nLqshLr5YqnRv7OQmwukktawdOc"
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
ot-baggage-auth0-request-id: 6ee0f0a6a8066955
ot-tracer-sampled: true
ot-tracer-spanid: 7d15eb2054d27f86
ot-tracer-traceid: 19c84a7d145f1d6f
referrer-policy: same-origin
x-auth0-requestid: 6f217a8481dfab70ab84
x-content-type-options: nosniff
x-ratelimit-limit: 1000
x-ratelimit-remaining: 999
x-ratelimit-reset: 1647637670
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block
server: cloudflare
x-akamai-transformed: 9 - 0 pmb=mTOE,3
vary: Accept-Encoding
content-encoding: gzip
expires: Fri, 18 Mar 2022 21:07:49 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Fri, 18 Mar 2022 21:07:49 GMT
content-length: 20481

Redirect headers

content-type: text/html; charset=utf-8
content-length: 640
location: /login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
cf-ray: 6ee0f0a418b79bce-FRA
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
ot-baggage-auth0-request-id: 6ee0f0a418b79bce
ot-tracer-sampled: true
ot-tracer-spanid: 43672d59621e92df
ot-tracer-traceid: 59bd24314e89efd4
x-auth0-requestid: bf2a2cf67ea86a53eb2d
x-content-type-options: nosniff
x-ratelimit-limit: 1000
x-ratelimit-remaining: 998
x-ratelimit-reset: 1647637669
server: cloudflare
expires: Fri, 18 Mar 2022 21:07:48 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Fri, 18 Mar 2022 21:07:48 GMT

GET
H/1.1 200
OK F
myaccount.heraldsun.com.au/profilephoto/005/ 3 KB
4 KB 281ms
280ms Image
image/png 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myaccount.heraldsun.com.au/profilephoto/005/F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:48 GMT
Last-Modified: Sun, 30 Jun 2019 16:00:26 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
P3P: CP="CUR OTR STA"
Cache-Control: public,max-age=3888000
Content-Type: image/png
Content-Length: 3553
Expires: Mon, 02 May 2022 21:07:48 GMT

GET
H/1.1 200
OK HeraldSun.png
myaccount.heraldsun.com.au/resource/1639034195000/Masthead_compressed_metros/ 4 KB
4 KB 282ms
281ms Image
image/png 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myaccount.heraldsun.com.au/resource/1639034195000/Masthead_compressed_metros/HeraldSun.png

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:48 GMT
Last-Modified: Thu, 9 Dec 2021 07:16:35 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
P3P: CP="CUR OTR STA"
Cache-Control: public,max-age=3888000,immutable
Content-Type: image/png
Content-Length: 3967
Expires: Mon, 02 May 2022 21:07:48 GMT

GET
H/1.1 200
OK Footer-phone-icon.svg
myaccount.heraldsun.com.au/resource/1625040238000/branding_assets_metros_theme/ 741 B
802 B 280ms
279ms Image
image/svg+xml 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myaccount.heraldsun.com.au/resource/1625040238000/branding_assets_metros_theme/Footer-phone-icon.svg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:48 GMT
Content-Encoding: gzip
Last-Modified: Wed, 30 Jun 2021 08:03:58 GMT
Vary: Accept-Encoding
P3P: CP="CUR OTR STA"
Cache-Control: public,max-age=3888000,immutable
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: image/svg+xml
Content-Length: 427
Expires: Mon, 02 May 2022 21:07:48 GMT

GET
H/1.1 200
OK Footer-email-icon.svg
myaccount.heraldsun.com.au/resource/1625040238000/branding_assets_metros_theme/ 824 B
864 B 332ms
332ms Image
image/svg+xml 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myaccount.heraldsun.com.au/resource/1625040238000/branding_assets_metros_theme/Footer-email-icon.svg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:48 GMT
Content-Encoding: gzip
Last-Modified: Wed, 30 Jun 2021 08:03:58 GMT
Vary: Accept-Encoding
P3P: CP="CUR OTR STA"
Cache-Control: public,max-age=3888000,immutable
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: image/svg+xml
Content-Length: 489
Expires: Mon, 02 May 2022 21:07:48 GMT

GET
H2 200 cxbus.min.js
apps.mypurecloud.com.au/cxbus/ Frame A65F 20 KB
7 KB 275ms
274ms Script
text/javascript 13.237.244.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com.au/cxbus/cxbus.min.js

Requested by

Host: apps.mypurecloud.com.au
URL: https://apps.mypurecloud.com.au/messenger/messenger.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.237.244.18 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-237-244-18.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com.au/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:48 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 23:36:08 GMT
server: nginx
x-amz-request-id: GMB1JT38EEJHJZD1
etag: "03eac80149ca14bf8b4abfc4316c8ec0"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 7186
x-amz-version-id: caH_RRaqi5zhszUaYYa_AplaLxzSXsoF
x-amz-id-2: W8DXvBysEAPZBU4AnB/jzx5LzNqvNED4AOLndt516X5IiT9U12cloE4CRXdhf85gZnvyVzJVyf4=

GET
H2 200 defaultVendors.min.js
apps.mypurecloud.com.au/messenger/ Frame A65F 165 KB
46 KB 273ms
272ms Script
text/javascript 13.237.244.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com.au/messenger/defaultVendors.min.js

Requested by

Host: apps.mypurecloud.com.au
URL: https://apps.mypurecloud.com.au/messenger/newrelic/newrelic-agent.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.237.244.18 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-237-244-18.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com.au/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:48 GMT
content-encoding: gzip
last-modified: Wed, 16 Mar 2022 16:07:30 GMT
server: nginx
x-amz-request-id: Y13772ZNHCDQ94FK
etag: "86c62257ebcd3dbef8d6f5a7e1a540b1"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 46287
x-amz-version-id: KHnaodCyOjYvBeSV4pBFWSUNK7u2pnvH
x-amz-id-2: 2QKWxP3rr7uyA67RjYfaiDWwf80zrno3qRRal5sH9F2UkGiNWJSYErnp2ITIydLhLYwqB2gExc0=

GET
H2 200 vendors.min.js
apps.mypurecloud.com.au/messenger/ Frame A65F 183 KB
59 KB 544ms
543ms Script
text/javascript 13.237.244.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com.au/messenger/vendors.min.js

Requested by

Host: apps.mypurecloud.com.au
URL: https://apps.mypurecloud.com.au/messenger/newrelic/newrelic-agent.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.237.244.18 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-237-244-18.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com.au/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:48 GMT
content-encoding: gzip
last-modified: Wed, 16 Mar 2022 16:07:30 GMT
server: nginx
x-amz-request-id: GMB3EABMWF38M0FC
etag: "0aa86665620ebebcaa0ebaf635991147"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 60321
x-amz-version-id: OH53fz4jHVQ9wJlSoiPfhklljomLyuym
x-amz-id-2: c/0RB/2xDrrgTnBrvYCYNohJNBVDlm/WfZjijOBgOru3xqy1O1eJAMxX9bmlXAJKswgryG3nldQ=

GET main.min.js
apps.mypurecloud.com.au/messenger/ Frame A65F 0
0

GET engage.min.js
apps.mypurecloud.com.au/messenger/ Frame A65F 0
0

POST
H/1.1 200
OK aura
myaccount.heraldsun.com.au/s/sfsites/ 1 KB
1 KB 299ms
299ms XHR
application/json 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/aura?r=3&aura.Component.reportFailedAction=1&ui-comm-runtime-components-aura-components-siteforce-qb.Quarterback.getAllowedPostMessageOrigins=1

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
X-SFDC-Page-Cache: 3de09bb33c6ab9f5
Accept-Language: de-DE,de;q=0.9
X-SFDC-Page-Scope-Id: 712ba212-af01-4e20-a153-678c168bdf41
X-SFDC-Request-Id: 34666000001056e880
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Fri, 18 Mar 2022 21:07:48 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 18 Mar 2021 21:07:48 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: application/json;charset=UTF-8
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Server-Timing: Total;dur=23
Timing-Allow-Origin: *
Vary: Origin, Accept-Encoding
X-XSS-Protection: 1; mode=block
Expires: Thu, 18 Mar 2021 21:07:48 GMT

POST
H/1.1 200
OK aura
myaccount.heraldsun.com.au/s/sfsites/ 1 KB
1 KB 323ms
322ms XHR
application/json 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/aura?r=4&other.MyAcc_VerticalNav.getNotificationCount=1

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
X-SFDC-Page-Cache: 3de09bb33c6ab9f5
Accept-Language: de-DE,de;q=0.9
X-SFDC-Page-Scope-Id: 712ba212-af01-4e20-a153-678c168bdf41
X-SFDC-Request-Id: 36192900009b76cd48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Fri, 18 Mar 2022 21:07:48 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 18 Mar 2021 21:07:49 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: application/json;charset=UTF-8
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Server-Timing: Total;dur=50
Timing-Allow-Origin: *
Vary: Origin, Accept-Encoding
X-XSS-Protection: 1; mode=block
Expires: Thu, 18 Mar 2021 21:07:49 GMT

POST
H/1.1 200
OK aura
myaccount.heraldsun.com.au/s/sfsites/ 1 KB
1 KB 331ms
331ms XHR
application/json 161.71.21.33
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://myaccount.heraldsun.com.au/s/sfsites/aura?r=5&other.MyAcc_Base.getTileMenuList=1

Requested by

Host: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraFW/javascript/hXQ6H-x_YQB1RZ2gyQB4Mg/aura_prod.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

161.71.21.33 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

lo2.4.0p12v000001uyqecaq.00d90000000zujneaq.gslb.siteforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myaccount.heraldsun.com.au/s/?cid=19021054
X-SFDC-Page-Cache: 3de09bb33c6ab9f5
Accept-Language: de-DE,de;q=0.9
X-SFDC-Page-Scope-Id: 712ba212-af01-4e20-a153-678c168bdf41
X-SFDC-Request-Id: 3638290000b08e155b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Fri, 18 Mar 2022 21:07:48 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 18 Mar 2021 21:07:49 GMT
Strict-Transport-Security: max-age=63072004; includeSubDomains
Content-Type: application/json;charset=UTF-8
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Server-Timing: Total;dur=58
Timing-Allow-Origin: *
Vary: Origin, Accept-Encoding
X-XSS-Protection: 1; mode=block
Expires: Thu, 18 Mar 2021 21:07:49 GMT

POST aura
myaccount.heraldsun.com.au/s/sfsites/ 0
0

POST auraAnalytics
myaccount.heraldsun.com.au/s/sfsites/ 0
0

GET
H2 200 c98e248 Show response
login.newscorpaustralia.com/akam/13/ 26 KB
9 KB 16ms
14ms Script
application/javascript 104.111.230.77
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://login.newscorpaustralia.com/akam/13/c98e248
Requested by: Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.230.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-77.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7c3ba8bbf99673b8bbc645be8bb7c34ec4e9d2386334855a5623542dec9eab94

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:49 GMT
content-encoding: gzip
last-modified: Wed, 09 Feb 2022 15:13:23 GMT
etag: "2efdc367c05c912bfaae90253df0fd3d7cb0875289bb46d4b3b62ed82df6c576"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
content-length: 8807
expires: Fri, 18 Mar 2022 21:07:49 GMT

GET
H2 200 lock.min.js Show response
cdn.auth0.com/js/lock/11.27.1/ 830 KB
236 KB 67ms
14ms Script
application/javascript 13.226.158.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.auth0.com/js/lock/11.27.1/lock.min.js
Requested by: Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.158.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-158-58.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37869bc88791225a9ffb4e87899f2b531c6a6a885dc86c9b03954b017cc56e5d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id: cM9JXrUlv4xNNRtxp3CBmHCk42ZgK5O4
content-encoding: gzip
last-modified: Tue, 27 Oct 2020 10:20:26 GMT
server: AmazonS3
age: 65197
etag: W/"a185291fb5caceb12c268448ad1c163d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 90dd5141cd2d05c51d479a582cded280.cloudfront.net (CloudFront)
cache-control: max-age=2628000,public
date: Fri, 18 Mar 2022 03:01:13 GMT
x-amz-replication-status: COMPLETED
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: T-ISKum01Dioxro7xHiMJ3UgjABaqTG70O5-j6MHyJaDF3zsaMfhDQ==

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
967 B 135ms
48ms Script
text/javascript 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

32a97e6497cd6c3a611286892f51f127409221715c0cb3f2795f8c480bc76de4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 554
x-xss-protection: 1; mode=block
expires: Fri, 18 Mar 2022 21:07:49 GMT

GET
H2 200 RwkaWY Show response
login.newscorpaustralia.com/rirKVnXe-_xyJlIv-cAvSJiaD-M/7h1akfptfu/fSZnAQ/BFk6S/ 84 KB
21 KB 13ms
11ms Script
application/javascript 104.111.230.77
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://login.newscorpaustralia.com/rirKVnXe-_xyJlIv-cAvSJiaD-M/7h1akfptfu/fSZnAQ/BFk6S/RwkaWY
Requested by: Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.230.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-77.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fa43fd4073d3976c0bc94de0d58e6f81290443515528b60e80aa889fa38f80c2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:49 GMT
content-encoding: gzip
last-modified: Mon, 28 Feb 2022 19:29:24 GMT
etag: "a7a61709860c0c57ec0c92584ae4f1bc214dfc71043ea43843572e55d14841f6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=21600
content-length: 20456

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/newsltd/auth/prod/ 26 KB
9 KB 127ms
109ms Script
application/x-javascript 2.18.232.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/newsltd/auth/prod/utag.js
Requested by: Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-232.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 538241319ce6d7c8f007947c471c9db1a625ae0238f1ac0a0919cc31bd6ee39a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:49 GMT
content-encoding: gzip
last-modified: Mon, 28 Feb 2022 07:08:16 GMT
server: AkamaiNetStorage
etag: "c408648c9383b2a8e6a8849411a2a637:1646032096.543397"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 9135
expires: Fri, 18 Mar 2022 21:12:49 GMT

GET
H2 200 SourceSansPro-Regular.woff2
subscriptions.news.com.au/media/fonts/SourceSansPro/ 83 KB
83 KB 52ms
14ms Font
binary/octet-stream 13.226.145.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://subscriptions.news.com.au/media/fonts/SourceSansPro/SourceSansPro-Regular.woff2
Requested by: Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.145.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-145-105.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89de2f207fac8289b2b0d7300b282db8347db9f3098a30662c72ced8c199971c

Request headers

Referer: https://login.newscorpaustralia.com/
Origin: https://login.newscorpaustralia.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 02:46:36 GMT
via: 1.1 58dd513f0a53b3e6851a071cb857a706.cloudfront.net (CloudFront)
age: 66074
x-cache: Hit from cloudfront
content-length: 84808
last-modified: Wed, 23 Sep 2020 08:43:40 GMT
server: AmazonS3
etag: "84900d939c3d3911d3a7d936cae4f3a6"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: HGUZ0F9RdAEWfB40COdzBzaJoUnKDPkQ
access-control-allow-origin: *
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-type: binary/octet-stream
x-amz-cf-id: 2ULF8Dwn6lPiTxUsAqR2SFmpMZ7jWOLC3vr-ylVTWe_IOgF8vwdCfA==

GET
H2 200 logo.png
resourcesssl.newscdn.com.au/cs/auth0/images/heraldsun/ 8 KB
9 KB 143ms
19ms Image
image/png 2.18.233.169
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resourcesssl.newscdn.com.au/cs/auth0/images/heraldsun/logo.png
Requested by: Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.169 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-169.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 7c168fe749ede67d5456613fade9bbc9d7143b4c3fb1a95098a9b41c00c50822

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:49 GMT
last-modified: Fri, 11 Jan 2019 00:33:34 GMT
server: AmazonS3
x-amz-request-id: 2AE0SM8B63S0FH5D
etag: "0fb9a6c439663c66064190f8200ba087"
content-type: image/png
cache-control: max-age=564068
accept-ranges: bytes
content-length: 8576
x-amz-id-2: 4NE8OuB5O2LeWzfFo9ztxt1fhE7YsMr85bbimGgd9GepKv9vqCaIpiiIcNzJRfgO3VQ6uZbPYZQ=
expires: Fri, 25 Mar 2022 09:48:57 GMT

POST
H2 201 RwkaWY Show response
login.newscorpaustralia.com/rirKVnXe-_xyJlIv-cAvSJiaD-M/7h1akfptfu/fSZnAQ/BFk6S/ 18 B
716 B 367ms
367ms XHR
application/json 104.111.230.77
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://login.newscorpaustralia.com/rirKVnXe-_xyJlIv-cAvSJiaD-M/7h1akfptfu/fSZnAQ/BFk6S/RwkaWY
Requested by: Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/rirKVnXe-_xyJlIv-cAvSJiaD-M/7h1akfptfu/fSZnAQ/BFk6S/RwkaWY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.230.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-77.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: bef9393fcdfc7a7299c058ba2a69253c32e0964dd3e97834e17a8cdb5dce7cf6

Request headers

Referer: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 18 Mar 2022 21:07:49 GMT
vary: Origin
content-type: application/json
access-control-allow-origin: https://login.newscorpaustralia.com
access-control-allow-credentials: true
x_req_id: 862c654f-0945-4c51-8255-9f9f4f3f89ae
access-control-allow-headers: Content-Type
content-length: 18

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63b693778274923011281f0c339ac4116f8a31b9d186d0657849380cd5bd34b7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 157 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 en.js Show response
cdn.auth0.com/js/lock/11.27.1/ 6 KB
3 KB 11ms
11ms Script
application/javascript 13.226.158.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.auth0.com/js/lock/11.27.1/en.js
Requested by: Host: cdn.auth0.com
URL: https://cdn.auth0.com/js/lock/11.27.1/lock.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.158.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-158-58.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 274a08ddc700fc754cb977c38b9fa34cc0dac17b9d768da40c81b502b97862f6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 04:06:33 GMT
content-encoding: gzip
last-modified: Tue, 27 Oct 2020 10:20:25 GMT
server: AmazonS3
age: 61277
etag: W/"752bd942891e49a1035e916dd81017a5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: sEPUM911esdPLwmsbpJBk1yq6J.MYmIz
via: 1.1 90dd5141cd2d05c51d479a582cded280.cloudfront.net (CloudFront)
cache-control: max-age=2628000,public
x-amz-replication-status: COMPLETED
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
x-amz-cf-id: 6EzyTa-QXNWKf_E7okzdXv7hMM0PF0NkvQQK4RtbcaXeGnUaMYg94w==

GET
H2 200 AnudjFSZnp48OLKBaaB382z4LHeAfIS5.js Show response
login.newscorpaustralia.com/client/ 2 KB
1 KB 461ms
460ms Script
application/x-javascript 104.111.230.77
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://login.newscorpaustralia.com/client/AnudjFSZnp48OLKBaaB382z4LHeAfIS5.js?t1647637669609

Requested by

Host: cdn.auth0.com
URL: https://cdn.auth0.com/js/lock/11.27.1/lock.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.230.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-230-77.deploy.static.akamaitechnologies.com

Software

cloudflare /

Resource Hash

70a0f883663024535217be26f98d72f2a778b93a20123f7485a883af0ad80565

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-auth0-requestid: 1a131ff5a8d100d93185
content-length: 768
etag: W/"82f-H8GhPn2iR9a7ik/saB7xkfInLLw"
cf-bgj: minify
server: cloudflare
ot-tracer-sampled: true
date: Fri, 18 Mar 2022 21:07:50 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
ot-tracer-traceid: 23dfad1e5445bb09
cache-control: public, max-age=56
ot-baggage-auth0-request-id: 6edc19d6bf139b25
cf-ray: 6ee0f0ab5d989b55-FRA
ot-tracer-spanid: 6e3ca1ce209c8837

POST
H2 200 challenge Show response
login.newscorpaustralia.com/usernamepassword/ 18 B
717 B 404ms
404ms XHR
application/json 104.111.230.77
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://login.newscorpaustralia.com/usernamepassword/challenge

Requested by

Host: cdn.auth0.com
URL: https://cdn.auth0.com/js/lock/11.27.1/lock.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.230.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-230-77.deploy.static.akamaitechnologies.com

Software

cloudflare /

Resource Hash

8376431f05ed0574aa914db9f36153ed5837a067d6d3450847c49d89b37ad1bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Auth0-Client: eyJuYW1lIjoibG9jay5qcy11bHAiLCJ2ZXJzaW9uIjoiMTEuMjcuMSIsImVudiI6eyJhdXRoMC5qcy11bHAiOiI5LjE0LjAiLCJhdXRoMC5qcyI6IjkuMTQuMCJ9fQ==
Referer: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/json

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-auth0-requestid: d251c24d6566362e6711
date: Fri, 18 Mar 2022 21:07:50 GMT
content-length: 18
pragma: no-cache
expires: Fri, 18 Mar 2022 21:07:50 GMT
server: cloudflare
ot-tracer-sampled: true
etag: W/"12-9fs4x/hyJ5DkqQF2LYZkOdHRWWM"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/json; charset=utf-8
ot-tracer-traceid: 245586a04ba96559
cache-control: max-age=0, no-cache, no-store
ot-baggage-auth0-request-id: 6ee0f0ab3c81921f
cf-ray: 6ee0f0ab3c81921f-FRA
ot-tracer-spanid: 5a116c6d4b5eb8b7

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/zLD1nfkNCJC1kEswSRdSyd-p/ 360 KB
143 KB 124ms
39ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/zLD1nfkNCJC1kEswSRdSyd-p/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7aaea908b866c1619b9bf156a002c22b717a771bf22d9a2965151f9cf969670

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: https://login.newscorpaustralia.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3396
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 145350
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 04:02:07 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 18 Mar 2023 20:11:13 GMT

GET
H2 200 gdpr_user_check.esi Show response
tags.news.com.au/prod/data-esi/top/ 63 B
362 B 969ms
923ms XHR
text/plain 2.18.233.169
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.news.com.au/prod/data-esi/top/gdpr_user_check.esi
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/newsltd/auth/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.169 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-169.deploy.static.akamaitechnologies.com
Software: AkamaiGHost /
Resource Hash: c234d3a6e7ff0a41542220e1202ea768bffeca48680c47de404653fa040a9c7c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:50 GMT
server: AkamaiGHost
p3p: CP="News Ltd does not have a P3P policy. You can view our Privacy Policy at http://www.newscorpaustraliaprivacy.com"
etag: "519053bf13ef3980b8829a5ec0f4dbc4:1638256850.601476"
content-type: text/plain
access-control-allow-origin: *
cache-control: max-age=0, no-cache
content-length: 63
mime-version: 1.0
expires: Fri, 18 Mar 2022 21:07:50 GMT

POST
H2 201 RwkaWY Show response
login.newscorpaustralia.com/rirKVnXe-_xyJlIv-cAvSJiaD-M/7h1akfptfu/fSZnAQ/BFk6S/ 18 B
702 B 358ms
357ms XHR
application/json 104.111.230.77
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://login.newscorpaustralia.com/rirKVnXe-_xyJlIv-cAvSJiaD-M/7h1akfptfu/fSZnAQ/BFk6S/RwkaWY
Requested by: Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/rirKVnXe-_xyJlIv-cAvSJiaD-M/7h1akfptfu/fSZnAQ/BFk6S/RwkaWY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.230.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-77.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: bef9393fcdfc7a7299c058ba2a69253c32e0964dd3e97834e17a8cdb5dce7cf6

Request headers

Referer: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 18 Mar 2022 21:07:50 GMT
vary: Origin
content-type: application/json
access-control-allow-origin: https://login.newscorpaustralia.com
access-control-allow-credentials: true
x_req_id: 46b314de-8073-445f-820b-9fc089d2b677
access-control-allow-headers: Content-Type
content-length: 18

GET
H2 404 ssodata Show response
login.newscorpaustralia.com/user/ 0
412 B 447ms
447ms XHR
text/plain 104.111.230.77
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://login.newscorpaustralia.com/user/ssodata

Requested by

Host: cdn.auth0.com
URL: https://cdn.auth0.com/js/lock/11.27.1/lock.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.230.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-230-77.deploy.static.akamaitechnologies.com

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-auth0-requestid: 3490b51ed2101c5252b2
content-length: 0
pragma: no-cache
server: cloudflare
ot-tracer-sampled: true
date: Fri, 18 Mar 2022 21:07:50 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
ot-tracer-traceid: 5a4b540463c80d1b
expires: Fri, 18 Mar 2022 21:07:50 GMT
cache-control: max-age=0, no-cache, no-store
ot-baggage-auth0-request-id: 6ee0f0ae89119238
cf-ray: 6ee0f0ae89119238-FRA
ot-tracer-spanid: 561eb92046daf8e5

POST
H2 200 pixel_c98e248 Show response
login.newscorpaustralia.com/akam/13/ 0
597 B 16ms
15ms XHR
text/html 104.111.230.77
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://login.newscorpaustralia.com/akam/13/pixel_c98e248
Requested by: Host: login.newscorpaustralia.com
URL: https://login.newscorpaustralia.com/akam/13/c98e248
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.230.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-77.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login.newscorpaustralia.com/login?state=hKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ&client=AnudjFSZnp48OLKBaaB382z4LHeAfIS5&protocol=samlp&prevent_sign_up=true&prompt=none&site=heraldsun
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:50 GMT
cache-control: max-age=0, no-cache
expires: Fri, 18 Mar 2022 21:07:50 GMT
content-length: 0
content-type: text/html

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cfd309ec91b0036eb35802dedaffcd0976b187bd21a9a473d569ce0837913ad7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ba65bf654556a367c0fe373354aa9023ca90726e002376dcb92410f2e9ab2c96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: beb44ad388a302c67d11778d88cfbfd65a466787e5e292cbb3f785ea5f4a22d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf9b44b10a339d642ce06652810a464dec2e1f1c9e948a08142d1e65c3441cff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 Charter_Bold.otf
subscriptions.news.com.au/media/fonts/Charter/ 26 KB
27 KB 12ms
12ms Font
binary/octet-stream 13.226.145.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://subscriptions.news.com.au/media/fonts/Charter/Charter_Bold.otf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.145.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-145-105.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1c4cd614b9f50a0f51e6bae39e8737f619bbe53b7f42041126291e8af0cea0c8

Request headers

Referer: https://login.newscorpaustralia.com/
Origin: https://login.newscorpaustralia.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id: w7y9tQwpH2nTxmZjKGJHpTsRMugW1jYV
via: 1.1 58dd513f0a53b3e6851a071cb857a706.cloudfront.net (CloudFront)
etag: "c05e130dc17dbd6167c9a0ce2ae69d6e"
age: 58930
x-cache: Hit from cloudfront
content-length: 26876
last-modified: Wed, 23 Sep 2020 08:43:11 GMT
server: AmazonS3
date: Fri, 18 Mar 2022 04:45:41 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: AYwZUmVpR2wvs8ZxUpxZl595ynPdJ43-mJYyjZYCgRDChfA17opemQ==

GET
H2 200 metrics.js Show response
tags.news.com.au/prod/metrics/ 181 KB
62 KB 26ms
25ms Script
application/x-javascript 2.18.233.169
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.news.com.au/prod/metrics/metrics.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/newsltd/auth/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.169 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-169.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d8aa84f8b7f0e4fe51f6080421619b56e2785f75bf62bd0c079256239c0c8b5e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:50 GMT
content-encoding: gzip
server: AkamaiNetStorage
etag: "5ed752b58987ea67910b88bca9ab2714:1641876997.320689"
vary: Accept-Encoding
p3p: CP="News Ltd does not have a P3P policy. You can view our Privacy Policy at http://www.newscorpaustraliaprivacy.com"
cache-control: max-age=11672
content-type: application/x-javascript

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 7ms
7ms Script
application/x-javascript 2.18.232.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=newsltd/auth/202202280708&cb=1647637670662
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/newsltd/auth/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-232.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:50 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Fri, 18 Mar 2022 21:17:50 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 5 KB
2 KB 115ms
30ms XHR
application/json 54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.1.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=5FE61C8B533204850A490D4D%40AdobeOrg&d_nsid=0&ts=1647637670709

Requested by

Host: tags.news.com.au
URL: https://tags.news.com.au/prod/metrics/metrics.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

b1d292fa0d2fe96a5e8e02a95800fe7f82a7c9f9e0af627f4c10bd50e9e741b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v030-083d49765.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: Ff9IkpOOSZU=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://login.newscorpaustralia.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1544
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK dest5.html Show response
newscorpau.demdex.net/ Frame F6DA 7 KB
3 KB 140ms
33ms Document
text/html 63.35.20.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://newscorpau.demdex.net/dest5.html?d_nsid=0

Requested by

Host: tags.news.com.au
URL: https://tags.news.com.au/prod/metrics/metrics.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

63.35.20.93 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-35-20-93.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Fri, 18 Mar 2022 21:07:50 GMT
DCS: dcs-prod-irl1-2-v030-00570eae8.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Tue, 15 Mar 2022 12:40:47 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: oh2E9EapRZQ=
transfer-encoding: chunked
Connection: keep-alive

GET
H2 200 id Show response
newscorpau.sc.omtrdc.net/ 2 B
325 B 63ms
17ms XHR
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://newscorpau.sc.omtrdc.net/id?d_visid_ver=5.1.1&d_fieldgroup=A&mcorgid=5FE61C8B533204850A490D4D%40AdobeOrg&mid=59597112673909552891180680066540033961&ts=1647637670834

Requested by

Host: tags.news.com.au
URL: https://tags.news.com.au/prod/metrics/metrics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 18 Mar 2022 21:07:50 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-7f6b754cd4-s7qlb
vary: Origin
x-c: main-1629.I879dac.M0-556
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://login.newscorpaustralia.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 2
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YjT0pgAAAIUE6gQS
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=59621068440847191071182778776105486003
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YjT0pgAAAIUE6gQS

42 B
945 B

37ms
30ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YjT0pgAAAIUE6gQS

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-0d2b4133c.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: yfm6dWiVQU8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YjT0pgAAAIUE6gQS
Date: Fri, 18 Mar 2022 21:07:50 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 5 KB
2 KB 32ms
32ms XHR
application/json 54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.1.1&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5FE61C8B533204850A490D4D%40AdobeOrg&d_nsid=0&d_mid=59597112673909552891180680066540033961&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&ts=1647637670900

Requested by

Host: tags.news.com.au
URL: https://tags.news.com.au/prod/metrics/metrics.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

10933537a8cb30c81481ec42b4bdb6310944c721962f300357c369b7c8e72cee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v030-04298c2a3.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: u3BFBwiUTAY=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://login.newscorpaustralia.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1544
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 s95091828532204
newscorpau.sc.omtrdc.net/b/ss/newscorpau-global/1/JS-2.22.0/ 43 B
222 B 17ms
17ms Image
image/gif 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://newscorpau.sc.omtrdc.net/b/ss/newscorpau-global/1/JS-2.22.0/s95091828532204?AQB=1&ndh=1&pf=1&t=18%2F2%2F2022%2021%3A7%3A50%205%200&mid=59597112673909552891180680066540033961&aamlh=6&ce=UTF-8&ns=newscorpau&cdp=2&pageName=auth%7C%7Cauth%7Clog%20in&g=https%3A%2F%2Flogin.newscorpaustralia.com%2Flogin%3Fstate%3DhKFo2SBSTmFjQ2lRM1hnLWlDWFNNczB1RUtNbW4zTG04eENuUKFupWxvZ2luo3RpZNkgbmtxY0VnbWxjdnFVbmp4UFNfV3E0dWUtM2J1N0puN2mjY2lk2SBBbnVkakZTWm5wNDhPTEtCYWFCMzgyejRMSGVBZklTNQ%26client%3DAnudjFSZnp48OLKBaaB382z4LHeAfIS5%26prot&r=https%3A%2F%2Fmyaccount.heraldsun.com.au%2F&cc=AUD&ch=D%3Dv4&events=event1%2Cevent8%2Cevent63%3D23&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=D%3Dv1&v1=news%20corp%20au&h1=news%20corp%20au%7Cherald%20sun%7Cauthentication&c2=D%3Dv2&v2=herald%20sun&c3=D%3Dv3&v3=authentication&c9=D%3Dv9&v9=auth&c10=D%3Dg&v10=D%3DpageName&c11=D%3Dv11&v11=D%3Dvid&c14=D%3Dv14&v14=anonymous&c22=D%3Dv22&v22=8%3A07%20AM%7CSaturday&c24=D%3Dv24&v24=New&c30=First%20Visit&v34=D%3Dg&c45=landscape&c46=D%3Dv46&v46=not%20logged%20in&v52=1600x1200%7Cwindows%7C10&c60=D%3Dv60&v60=23&c65=D%3Dv65&v65=false&v76=chrome%20pdf%20plugin%3Bchrome%20pdf%20viewer%3Bnative%20client&v77=D%3Dmid&v111=0&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&-g=ocol%3Dsamlp%26prevent_sign_up%3Dtrue%26prompt%3Dnone%26site%3Dheraldsun&mcorgid=5FE61C8B533204850A490D4D%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:50 GMT
x-content-type-options: nosniff
x-c: main-1629.I879dac.M0-556
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 19 Mar 2022 21:07:50 GMT
server: jag
xserver: anedge-7f6b754cd4-kzdgr
etag: 3538274954319069184-4619576569024599880
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 17 Mar 2022 21:07:50 GMT

GET
H/1.1

200
OK

ibs:dpid=358&dpuuid=6345117155756232103
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID
https://dpm.demdex.net/ibs:dpid=358&dpuuid=6345117155756232103

42 B
945 B

30ms
30ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=358&dpuuid=6345117155756232103

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-0ea54742f.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: zMYuIqSVQes=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 21:07:51 GMT
X-Proxy-Origin: 185.213.155.169; 185.213.155.169; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 52cf8400-7867-4658-8b51-de5158af49c5
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dpm.demdex.net/ibs:dpid=358&dpuuid=6345117155756232103
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=470&dpuuid=2422800323313849989
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjM2NTYzMjkvdC8y/url/https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D470%26dpuuid%3D%24!%7BTURN_UUID%7D
https://dpm.demdex.net/ibs:dpid=470&dpuuid=2422800323313849989

42 B
945 B

30ms
30ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=470&dpuuid=2422800323313849989

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-0a6c4291d.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: E4432TFhSqQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=470&dpuuid=2422800323313849989
pragma: no-cache
date: Fri, 18 Mar 2022 21:07:50 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1 204
No Content token
token.rubiconproject.com/ Frame F6DA 0
214 B 30ms
7ms Image
text/plain 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=6404&puid=59621068440847191071182778776105486003&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 SourceSansPro-SemiBold.woff2
subscriptions.news.com.au/media/fonts/SourceSansPro/ 82 KB
82 KB 13ms
13ms Font
binary/octet-stream 13.226.145.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://subscriptions.news.com.au/media/fonts/SourceSansPro/SourceSansPro-SemiBold.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.145.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-145-105.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0d5be1300b44db64be1a50224d95e5c9ed1809b44887d06eca12365fe09875f8

Request headers

Referer: https://login.newscorpaustralia.com/
Origin: https://login.newscorpaustralia.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 03:06:20 GMT
via: 1.1 58dd513f0a53b3e6851a071cb857a706.cloudfront.net (CloudFront)
age: 64892
x-cache: Hit from cloudfront
content-length: 83828
last-modified: Wed, 23 Sep 2020 08:43:42 GMT
server: AmazonS3
etag: "d0b9da7413bfb1500e9284dfadfeb86a"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: HkmbYkNu5MZeNRmr5pf04rqDRWgMyTAI
access-control-allow-origin: *
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-type: binary/octet-stream
x-amz-cf-id: 5VvU44sngkjC68CrOGR5gdr6FE3j7drIKDKXy1oG2-GWl5iEik85aA==

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEPP728TvDKPCQAiCu0OMZUI&google_cver=1
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NTk2MjEwNjg0NDA4NDcxOTEwNzExODI3Nzg3NzYxMDU0ODYwMDM=
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NTk2MjEwNjg0NDA4NDcxOTEwNzExODI3Nzg3NzYxMDU0ODYwMDM=&google_tc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEPP728TvDKPCQAiCu0OMZUI&google_cver=1?gdpr=0&gdpr_consent=

42 B
945 B

42ms
42ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEPP728TvDKPCQAiCu0OMZUI&google_cver=1?gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-07afd4256.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: dYEeBVKcQYs=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEPP728TvDKPCQAiCu0OMZUI&google_cver=1?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=903&dpuuid=34e3611a-6475-47a7-b2ce-538b2af8c104
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1
https://dpm.demdex.net/ibs:dpid=903&dpuuid=34e3611a-6475-47a7-b2ce-538b2af8c104

42 B
945 B

31ms
30ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=34e3611a-6475-47a7-b2ce-538b2af8c104

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-0b737a958.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: UttkSIesS14=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:51 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=34e3611a-6475-47a7-b2ce-538b2af8c104
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 189

GET
H/1.1

200
OK

ibs:dpid=19566&dpuuid=%s
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://image5.pubmatic.com/AdServer/usersync/usersync.html?predirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=19566%26dpuuid=PM_UID&userIdMacro=PM_UID
https://dpm.demdex.net/ibs:dpid=19566&dpuuid=%s

42 B
963 B

31ms
30ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=19566&dpuuid=%s

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-0860a7bc2.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-Error: 303,104
X-TID: bN+XnIVOQE8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:51 GMT
server: nginx
etag: "615e720b-cde"
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
location: https://dpm.demdex.net/ibs:dpid=19566&dpuuid=%s
cache-control: max-age=0, no-cache, no-store
content-type: text/html
content-length: 154
expires: Fri, 18 Mar 2022 21:07:51 GMT

GET
H/1.1

200
OK

ibs:dpid=23728&dpuuid=YjT0p1KyqawYzPFdWN41fQAA%261195
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=183607&cb=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D23728%26dpuuid%3D__UID__
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D23728%26dpuuid%3D__UID__&s=183607&C=1
https://dpm.demdex.net/ibs:dpid=23728&dpuuid=YjT0p1KyqawYzPFdWN41fQAA%261195

42 B
945 B

32ms
32ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=YjT0p1KyqawYzPFdWN41fQAA%261195

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-0a672e30e.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: BZfpO3fjQG8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 21:07:51 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dpm.demdex.net/ibs:dpid=23728&dpuuid=YjT0p1KyqawYzPFdWN41fQAA%261195
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 264
Expires: Fri, 18 Mar 2022 21:07:51 GMT

GET
H/1.1

200
OK

ibs:dpid=30432&dpuuid=CI-e6ad6b5d8487c455159c644bbe718898
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://dt.scanscout.com/ssframework/uid?UIAA=59621068440847191071182778776105486003&url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30432%26dpuuid%3D%5BUSER_ID%5D
https://dpm.demdex.net/ibs:dpid=30432&dpuuid=CI-e6ad6b5d8487c455159c644bbe718898

42 B
945 B

30ms
30ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30432&dpuuid=CI-e6ad6b5d8487c455159c644bbe718898

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-0cacb0317.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: NNj2nDOhT38=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=30432&dpuuid=CI-e6ad6b5d8487c455159c644bbe718898
Date: Fri, 18 Mar 2022 21:07:51 GMT
useSecure: true
Server: openresty/1.19.9.1
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://ps.eyeota.net/match?bid=6j5b2cv&uid=59621068440847191071182778776105486003&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D
https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

42 B
963 B

29ms
29ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-035a33309.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-Error: 104,303
X-TID: nK9kbrYpQGg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=30064&dpuuid={UUID_6j5b2cv}
Date: Fri, 18 Mar 2022 21:07:51 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame F6DA
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=adobe&id=59621068440847191071182778776105486003
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=59621068440847191071182778776105486003

0
338 B

100ms
28ms

Image
text/plain

52.51.37.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=59621068440847191071182778776105486003
Protocol: H2
Server: 52.51.37.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-37-201.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 21:07:52 GMT
cache-control: private, no-cache, no-store
x-request-time: D=45 t=1647637672
x-served-by: beacon-n008-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=59621068440847191071182778776105486003
date: Fri, 18 Mar 2022 21:07:52 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a006-ash-prod.krxd.net

GET
H/1.1

200
OK

ibs:dpid=134096&dpuuid=$_BK_UUID
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://tags.bluekai.com/site/43981?id=59621068440847191071182778776105486003&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D134096%26dpuuid%3D%24_BK_UUID
https://dpm.demdex.net/ibs:dpid=134096&dpuuid=$_BK_UUID

42 B
963 B

29ms
29ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=134096&dpuuid=$_BK_UUID

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-0b3cdc53e.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-Error: 303,104
X-TID: nNSyxB9aRSY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=134096&dpuuid=$_BK_UUID
Date: Fri, 18 Mar 2022 21:07:52 GMT
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F6DA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WWpUMHBnQUFBSVVFNmdRUw==

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WWpUMHBnQUFBSVVFNmdRUw==

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647637672.130345,VS0,VE0
x-served-by: cache-hhn4021-HHN
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WWpUMHBnQUFBSVVFNmdRUw==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame F6DA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YjT0pgAAAIUE6gQS&expires=90

0
239 B

30ms
8ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YjT0pgAAAIUE6gQS&expires=90
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 611afce88997db6fdd35eb213e662871
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647637672.200860,VS0,VE0
x-served-by: cache-hhn4021-HHN
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YjT0pgAAAIUE6gQS&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F6DA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YjT0pgAAAIUE6gQS

43 B
1003 B

114ms
57ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YjT0pgAAAIUE6gQS
Protocol: HTTP/1.1
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 21:07:52 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 21:07:52 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647637672.301428,VS0,VE0
x-served-by: cache-hhn4021-HHN
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YjT0pgAAAIUE6gQS
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame F6DA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=YjT0pgAAAIUE6gQS

43 B
1 KB

19ms
19ms

Image
image/gif

37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=158&code=YjT0pgAAAIUE6gQS

Protocol

HTTP/1.1

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 21:07:52 GMT
X-Proxy-Origin: 185.213.155.169; 185.213.155.169; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 24a2b1dc-e9b0-4bfa-8c9e-1aee344f2451
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647637672.402645,VS0,VE0
x-served-by: cache-hhn4021-HHN
x-cache: HIT
location: https://ib.adnxs.com/setuid?entity=158&code=YjT0pgAAAIUE6gQS
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F6DA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YjT0pgAAAIUE6gQS

43 B
274 B

55ms
25ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YjT0pgAAAIUE6gQS
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
via: 1.1 google
server: OXGW/17.2.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647637673.503390,VS0,VE0
x-served-by: cache-hhn4021-HHN
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YjT0pgAAAIUE6gQS
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame F6DA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YjT0pgAAAIUE6gQS

1 B
549 B

44ms
15ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YjT0pgAAAIUE6gQS
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 14:49:14 GMT
cache-control: no-store, no-cache, private
x-lat: amspug0021:0:365
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647637673.604942,VS0,VE0
x-served-by: cache-hhn4021-HHN
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YjT0pgAAAIUE6gQS
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame F6DA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YjT0pgAAAIUE6gQS&img=1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YjT0pgAAAIUE6gQS&img=1&__user_check__=1&sync_id=79899548-a6ff-11ec-844c-19da87bf0506

43 B
548 B

17ms
17ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YjT0pgAAAIUE6gQS&img=1&__user_check__=1&sync_id=79899548-a6ff-11ec-844c-19da87bf0506
Protocol: HTTP/1.1
Server: 185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 21:07:52 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 63
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Fri, 18 Mar 2022 21:07:52 GMT
Server: nginx
Location: /partner?adv_id=6409&uid=YjT0pgAAAIUE6gQS&img=1&__user_check__=1&sync_id=79899548-a6ff-11ec-844c-19da87bf0506
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 136
Connection: keep-alive
Content-Length: 0

GET
H2

200

b.php
www.facebook.com/fr/ Frame F6DA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YjT0pgAAAIUE6gQS&t=2592000&o=0

43 B
605 B

55ms
40ms

Image
image/gif

2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=YjT0pgAAAIUE6gQS&t=2592000&o=0

Protocol

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 14:07:52 PDT
content-encoding: br
x-content-type-options: nosniff
document-policy: force-load-at-top
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-fb-rlafr: 0
pragma: public
x-fb-debug: A0eQhdkk/u/a1r4tZBPeM5yGk3b90yDgXFz+1EvBiXAbM8tYFnCq0+Fp+4uCarnZT2YkgAx4nTfayxqeLL+W0A==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
strict-transport-security: max-age=15552000; preload
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: image/gif
vary: Accept-Encoding
cache-control: public, max-age=0
priority: u=3,i
expires: Fri, 18 Mar 2022 14:07:52 PDT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647637673.805962,VS0,VE0
x-served-by: cache-hhn4021-HHN
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=YjT0pgAAAIUE6gQS&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 cm
trc.taboola.com/sg/adobe/1/ Frame F6DA 43 B
231 B 37ms
16ms Image
image/gif 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/adobe/1/cm?gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-vcl-time-ms: 10
pragma: no-cache
date: Fri, 18 Mar 2022 21:07:52 GMT
via: 1.1 varnish
server: nginx
x-timer: S1647637673.927197,VS0,VE10
x-served-by: cache-hhn4032-HHN
x-cache: MISS
cache-control: no-cache, no-store
accept-ranges: bytes
x-cache-hits: 0

GET
H/1.1

200
OK

ibs:dpid=461447&dpuuid=RX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003
dpm.demdex.net/ Frame F6DA
Redirect Chain

https://sync.1rx.io/usersync/adobe/0?dspret=1&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D461447%26dpuuid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync/adobe/0?zcc=1&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D461447%26dpuuid%3D%5BRX_UUID%5D&cb=1647637673050
https://sync.targeting.unrulymedia.com/csync/RX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D461447%26dpuuid%3DRX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003
https://dpm.demdex.net/ibs:dpid=461447&dpuuid=RX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003

42 B
945 B

31ms
30ms

Image
image/gif

54.194.75.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=461447&dpuuid=RX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003

Protocol

HTTP/1.1

Server

54.194.75.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-75-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newscorpau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-0a672e30e.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: xT2jnproRJM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=461447&dpuuid=RX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003
date: Fri, 18 Mar 2022 21:07:53 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXd3ec6e172c3540159b5e8a8b74da44b5003
content-type: text/html

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: apps.mypurecloud.com.au
URL: https://apps.mypurecloud.com.au/messenger/main.min.js

Domain: apps.mypurecloud.com.au
URL: https://apps.mypurecloud.com.au/messenger/engage.min.js

Domain: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/aura?r=6&ui-instrumentation-components-beacon.InstrumentationBeacon.sendData=1

Domain: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/aura?r=7&ui-search-components-forcesearch-sgdp.PermsAndPrefsCache.getPermsAndPrefs=1

Domain: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/aura?r=8&ui-comm-runtime-components-aura-components-siteforce-network-tracking.NetworkTracking.createLogRecord=1

Domain: myaccount.heraldsun.com.au
URL: https://myaccount.heraldsun.com.au/s/sfsites/auraAnalytics

Verdicts & Comments Add Verdict or Comment

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

54 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
login.newscorpaustralia.com/usernamepassword/login	1970-01-20 01:55:01	Name: _csrf Value: J0ICOAIxqfBuXrpbGKI1_Yap
.myaccount.heraldsun.com.au/s	1969-12-31 23:59:59	Name: renderCtx Value: %7B%22pageId%22%3A%22ab0d424b-4062-47c9-95f8-07c3383e5d37%22%2C%22schema%22%3A%22Published%22%2C%22viewType%22%3A%22Published%22%2C%22brandingSetId%22%3A%22923c573b-a87e-4e95-8b8b-21ccb9007df9%22%2C%22audienceIds%22%3A%22%22%7D
myaccount.heraldsun.com.au/	1970-01-20 10:26:13	Name: CookieConsentPolicy Value: 0:1
myaccount.heraldsun.com.au/	1970-01-20 10:26:13	Name: LSKey-c$CookieConsentPolicy Value: 0:1
.myaccount.heraldsun.com.au/	1970-01-20 10:26:13	Name: CookieConsentPolicy Value: 0:0
.myaccount.heraldsun.com.au/	1970-01-20 10:26:13	Name: LSKey-c$CookieConsentPolicy Value: 0:0
myaccount.heraldsun.com.au/	1970-01-20 01:40:48	Name: sfdc-stream Value: !C54G6d3z8A7ilIbkdN33zDYu6Nmjwm55hQnXM2HIjZFqapV3VJ7SDmI1/rfum5hxlkrLZy3JxqWhD7A=
login.newscorpaustralia.com/	1970-01-20 10:26:35	Name: did Value: s%3Av0%3A771fb240-a6ff-11ec-98f4-f58038f20b3c.oASrZ50tKOMBvGKArTHEdepDN%2FzXmAtQSLctkuf5V8M
login.newscorpaustralia.com/	1970-01-20 01:44:56	Name: auth0 Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQGGa9dcCd95j3ABFUszE344zsUc_fh5L95PG607qZQf3u8tdZA21bZDl7WTXgF751zIIeXnXsntgWzSj2sQoIA6mY29va2llg6dleHBpcmVz1_-tVI8AYjjpJK5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.mk0xVo5TYvN6Cul62hACS8MrWYDJNpiBizitM1WyQjY
login.newscorpaustralia.com/	1970-01-20 10:26:35	Name: did_compat Value: s%3Av0%3A771fb240-a6ff-11ec-98f4-f58038f20b3c.oASrZ50tKOMBvGKArTHEdepDN%2FzXmAtQSLctkuf5V8M
login.newscorpaustralia.com/	1970-01-20 01:44:56	Name: auth0_compat Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQGGa9dcCd95j3ABFUszE344zsUc_fh5L95PG607qZQf3u8tdZA21bZDl7WTXgF751zIIeXnXsntgWzSj2sQoIA6mY29va2llg6dleHBpcmVz1_-tVI8AYjjpJK5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.mk0xVo5TYvN6Cul62hACS8MrWYDJNpiBizitM1WyQjY
.newscorpaustralia.com/	1970-01-20 01:40:52	Name: bm_sz Value: CFE4EFC87C5E769FE886622C9201B154~YAAQdbsQAl8BxJd/AQAADqTbng8W6kfU8Gy0nmbQqev4BkxlPTg19YL4QuqQUaZvAnbHwScKX4i1pc6uJ0B1cRv6gGBthBJg9dIh3XR/HrbREM/2Sa+Pz5AKw15JnSnVe3GDKV8RcWzU/FrORaZjC4tg9vMpgZ2bzIqf4fndLyitjJBMrIk9M8XvNAdhnKhvJeZ/mqpWazgyBuWOeJvyXCQ1ZOqrpaFihFrNJwcpbUsZKcD7FMaMWtNG6V/kor+8id1ufuSFoH7J810cIBrXGZCFS4Retgmro4XK8AiHxOa4UqJH5u8++wHxhv7KTw==~3225399~4277574
myaccount.heraldsun.com.au/	1970-01-20 10:26:13	Name: pctrk Value: 0d2c6303-a14b-49a1-88ae-6a1ea1ee37e7
.newscorpaustralia.com/	1970-01-20 01:40:44	Name: bm_mi Value: 8FB41C7504D1A4E8E488E5F832A8D38F~rj1zIl+1OrgeU150Cep2+VCpnu/97wk6h1ehHW1iZIHYHC/0AYbtmpiG2nnUjM6nwtJeAglSR/E1Nazt71cQpQwH6byIrpXc2swTuOdjmwv0069w5iByl8HXFu2gFmwyEGjAdZcd1bl+4nimkD3m4N4d4U6bfpfjkVzUfez/YVnRSNjvJmBe9Yq8+3qQTE1+mkTj8GsQ6Pf7JP55sjpfkW7aqUDATGniBNGqJs1rBCGGTUdY+czPr6Gq9s+m3PM8mrWlHj4OLKn7M4focYGBevBB8ls+gs1Yeh6SK9dPF1I=
.newscorpaustralia.com/	1970-01-20 01:40:44	Name: bm_sv Value: 30258108C57B5D9767B52078F203337F~23d1uraIPHhN39/pjY+u3zOW6JOQbOFkiq3MZVIA1nfS7DZdYNnGy1R/bnzqnKP0mn41kJh5Q5pbpZwDTa+7xXRSBc9LTj/fqsEyOtkzq8CVhf3w5R7vkoC+cnSo6ZNTvtqsUaDheY1wdAfMnvpyTLprZWKQWkwpH714h4EUd5g=
.newscorpaustralia.com/	1970-01-20 01:40:44	Name: ak_bmsc Value: 3DA05E2E2074448F84EE2101A51F30BB~000000000000000000000000000000~YAAQdbsQAmIBxJd/AQAA6Kjbng8/uiZcFHD/BDbRPfpfF9rKe2mg1ZNP9Y1OJxMrAoI04uqI0PnbmMnz3/3AgezJ1VnSnbGayv3O8Jg6UQfPsItBniWXZ1WcZFWrZ9fnGGWUBZR8lV9BFHruvLakZbLXAqIYBAYSJoHthn/S6w5MPlrGjYrvbIjKqOXH2aA7CmgPmRcurzdBAr2JwvUEifRrO1g4o9thR1gNQ7gn08/wsLduNwzVn1fz4xid78suf4EpWBAIVswndFv5WEauGG+Ldqrt7INwIw7a6Km09cwrixm73DCBAHW57LE+ofnCg1HsYvYjXjFbq55J946z8M7bhLP+XE3zcVjhxqCvdfAoT4oyOvriV9KPz80HA3COm/u2TWj2UgInURWwrDHXmJwNIROzgg/BNVqqnL/52QG6OKU=
.newscorpaustralia.com/	1970-01-20 10:26:13	Name: _abck Value: 26BE5B5977D6348A07C34ED9DE4E082B~0~YAAQdbsQAmMBxJd/AQAAAKrbngfJZa5d5jVasgZc85mEB/TZoVVFBVdZ30xib9qA/fqI6W/oKXlUybo5HMlnEVTumPS8eP+oZFDPQa7YvfGvKz2F6+vjnF6fHDumx+eeowRm71MUzZ4nqqwqNPHEpgFzJk8weVKEeSDjvEDNTwRmbF6thtdIuKRUPNiDTw1zcVc5VW/u0uduKS+5Iw1LUnQ28Wnn9M4LfKpZ+TiBYTl10SQq5RAesazC2O4QSAYiFae79ams19LvBVKYdIf9QFnsUexroHbubmzSG9CI3ZTOU/GvRYOnuWLkJnHoiGieV+89d6ibCGu5R05Sr9czRTEkYghmd4K5bbeBvdZXE1h9B2Z99LzT6BCv7pFrf6HLelWiYQqJfU7/oFIdQ/EfYpYgrcE0LCQQdVoBNhxayw/Z5Bg=~-1~\|\|-1\|\|~-1
.newscorpaustralia.com/	1970-01-20 10:26:13	Name: utag_main Value: v_id:017f9edbab010022cd9184f6e48003072013906a00b08$_sn:1$_se:1$_ss:1$_st:1647639470658$ses_id:1647637670658%3Bexp-session$_pn:1%3Bexp-session
.demdex.net/	1970-01-20 05:59:49	Name: demdex Value: 59621068440847191071182778776105486003
.newscorpaustralia.com/	1969-12-31 23:59:59	Name: AMCVS_5FE61C8B533204850A490D4D%40AdobeOrg Value: 1
.everesttech.net/	1970-01-20 10:26:13	Name: everest_g_v2 Value: g_surferid~YjT0pgAAAIUE6gQS
.newscorpaustralia.com/	1969-12-31 23:59:59	Name: c_m Value: myaccount.heraldsun.com.auOther%20Natural%20Referrersundefined
.newscorpaustralia.com/	1970-01-20 02:23:49	Name: s_nr Value: 1647637670938-New
.newscorpaustralia.com/	1970-01-21 03:57:25	Name: s_gdslv Value: 1647637670938
.newscorpaustralia.com/	1970-01-20 01:40:39	Name: s_gdslv_s Value: First%20Visit
.newscorpaustralia.com/	1970-01-20 01:40:39	Name: s_ppn Value: auth%7C%7Cauth%7Clog%20in
.newscorpaustralia.com/	1969-12-31 23:59:59	Name: tp Value: 1200
.newscorpaustralia.com/	1969-12-31 23:59:59	Name: s_ppv Value: auth%257C%257Cauth%257Clog%2520in%2C100%2C100%2C1200
.newscorpaustralia.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.dpm.demdex.net/	1970-01-20 05:59:49	Name: dpm Value: 59621068440847191071182778776105486003
.newscorpaustralia.com/	1970-01-20 19:13:16	Name: AMCV_5FE61C8B533204850A490D4D%40AdobeOrg Value: -637568504%7CMCIDTS%7C19070%7CMCMID%7C59597112673909552891180680066540033961%7CMCAAMLH-1648242470%7C6%7CMCAAMB-1648242470%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C0%7CMCOPTOUT-1647644870s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19077%7CvVersion%7C5.1.1
.adnxs.com/	1970-01-20 03:50:13	Name: uuid2 Value: 6345117155756232103
.turn.com/	1970-01-20 05:59:49	Name: uid Value: 2422800323313849989
.adsrvr.org/	1970-01-20 10:26:13	Name: TDID Value: 34e3611a-6475-47a7-b2ce-538b2af8c104
.adsrvr.org/	1970-01-20 10:26:13	Name: TDCPM Value: CAESEgoDYWFtEgsIiIi11KzLxDoQBRgFIAEoAjILCKiVk4HDy8Q6EAU4AQ..
.doubleclick.net/	1970-01-20 11:02:13	Name: IDE Value: AHWqTUnUkqKmm06OS4VjMnjEaaaHvOv4qiTrFiD-tFtH8MeCYpOf99GUumgXS1PheOY
.casalemedia.com/	1970-01-20 10:26:13	Name: CMID Value: YjT0p1KyqawYzPFdWN41fQAA
.casalemedia.com/	1970-01-20 03:50:13	Name: CMPS Value: 3274
.casalemedia.com/	1970-01-20 03:50:13	Name: CMPRO Value: 1195
.eyeota.net/	1970-01-20 01:40:38	Name: SERVERID Value: 20164~DM
.scanscout.com/	1970-01-20 10:26:13	Name: uid Value: CI-e6ad6b5d8487c455159c644bbe718898
.scanscout.com/	1970-01-20 10:26:13	Name: UIAA Value: 59621068440847191071182778776105486003
.scanscout.com/	1970-01-20 10:26:13	Name: UIXX_UPDT Value: "UIAA=1647637671934"
.krxd.net/	1970-01-20 05:59:49	Name: _kuid_ Value: Oub9VwL0
.casalemedia.com/	1970-01-20 10:26:13	Name: CMRUM3 Value: 586234f4a82760YjT0pgAAAIUE6gQS
.casalemedia.com/	1970-01-20 01:42:04	Name: CMST Value: YjT0p2I09KgA
.adnxs.com/	1970-01-20 03:50:13	Name: anj Value: dTM7k!M4.FErk#WF']wIg2E?^iipDB!]tbPl1MwL(!R7qUY$cPiAB@YWJWx[5o)MD)MKUc=+-<QG=%9sk?bIRwi:w9Ld1_BDEi17Mco/y@Yw#u!:h*JX:e
.pubmatic.com/	1970-01-20 03:50:13	Name: KRTBCOOKIE_218 Value: 4056-YjT0pgAAAIUE6gQS&KRTB&22978-YjT0pgAAAIUE6gQS&KRTB&23194-YjT0pgAAAIUE6gQS&KRTB&23209-YjT0pgAAAIUE6gQS
.pubmatic.com/	1970-01-20 02:23:49	Name: PugT Value: 1647614954
.pubmatic.com/	1970-01-20 03:50:13	Name: PUBMDCID Value: 3
.spotxchange.com/	1970-01-20 10:26:17	Name: audience Value: 79899506-a6ff-11ec-844c-19da87bf0506
.demdex.net/	1970-01-20 05:59:49	Name: dextp Value: 358-1-1647637670986\|470-1-1647637671087\|481-1-1647637671188\|771-1-1647637671289\|903-1-1647637671390\|19566-1-1647637671491\|23728-1-1647637671593\|30432-1-1647637671694\|30064-1-1647637671795\|66757-1-1647637671896\|134096-1-1647637671996\|144230-1-1647637672097\|144231-1-1647637672198\|144232-1-1647637672299\|144233-1-1647637672400\|144234-1-1647637672501\|144235-1-1647637672602\|144236-1-1647637672702\|144237-1-1647637672803\|147592-1-1647637672904\|461447-1-1647637673005
.1rx.io/	1970-01-20 10:26:13	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003%22%7D
.targeting.unrulymedia.com/	1970-01-20 10:26:13	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-d3ec6e17-2c35-4015-9b5e-8a8b74da44b5-003%22%7D

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://myaccount.heraldsun.com.au/resource/1625040237000/NewsCorpAssets/NewsCorpAssets/newsCorpCustomCSS.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://myaccount.heraldsun.com.au/resource/1625040237000/NewsCorpAssets/NewsCorpAssets/fontawesome5/css/all.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://login.newscorpaustralia.com/user/ssodata Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests frame-ancestors *
Strict-Transport-Security	max-age=63072004; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-cdn.mypurecloud.com.au
api.mypurecloud.com.au
apps.mypurecloud.com.au
beacon.krxd.net
cdn.auth0.com
cm.everesttech.net
cm.g.doubleclick.net
d.turn.com
dpm.demdex.net
dsum-sec.casalemedia.com
dt.scanscout.com
ib.adnxs.com
image2.pubmatic.com
image5.pubmatic.com
login.newscorpaustralia.com
match.adsrvr.org
myaccount.heraldsun.com.au
myaccount.news.com.au
nebula-cdn.kampyle.com
newscorpau.demdex.net
newscorpau.sc.omtrdc.net
pixel.rubiconproject.com
ps.eyeota.net
resourcesssl.newscdn.com.au
ssum.casalemedia.com
subscriptions.news.com.au
sync-tm.everesttech.net
sync.1rx.io
sync.search.spotxchange.com
sync.targeting.unrulymedia.com
tags.bluekai.com
tags.news.com.au
tags.tiqcdn.com
token.rubiconproject.com
trc.taboola.com
us-u.openx.net
usermatch.krxd.net
www.facebook.com
www.google.com
www.gstatic.com
apps.mypurecloud.com.au
myaccount.heraldsun.com.au
104.108.144.214
104.108.145.8
104.111.230.77
104.92.72.137
13.226.145.105
13.226.145.82
13.226.158.58
13.237.244.18
142.250.185.130
15.188.95.229
15.197.193.217
151.101.65.175
151.101.66.49
161.71.21.33
185.64.189.110
185.94.180.125
199.127.207.184
2.18.232.232
2.18.233.169
2001:678:cb4:bbbb::13
213.19.147.44
2a00:1450:4001:801::2004
2a00:1450:4001:809::2003
2a03:2880:f12d:181:face:b00c:0:25de
2a04:4e42::300
3.125.70.222
34.226.104.236
34.98.64.218
37.252.172.123
52.50.18.68
52.51.37.201
54.194.75.122
63.35.20.93
69.173.144.139
69.173.144.165
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d5be1300b44db64be1a50224d95e5c9ed1809b44887d06eca12365fe09875f8
0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94
10933537a8cb30c81481ec42b4bdb6310944c721962f300357c369b7c8e72cee
1c4cd614b9f50a0f51e6bae39e8737f619bbe53b7f42041126291e8af0cea0c8
274a08ddc700fc754cb977c38b9fa34cc0dac17b9d768da40c81b502b97862f6
32a97e6497cd6c3a611286892f51f127409221715c0cb3f2795f8c480bc76de4
37869bc88791225a9ffb4e87899f2b531c6a6a885dc86c9b03954b017cc56e5d
378bccecf18292dcd22d7079658a59dc3bc05652597e770846b9e8665c996f2b
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
538241319ce6d7c8f007947c471c9db1a625ae0238f1ac0a0919cc31bd6ee39a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
6344c0b525bece86162de68ac33971b6453f5074fcaa0278f7f2443b2d334872
63b693778274923011281f0c339ac4116f8a31b9d186d0657849380cd5bd34b7
70a0f883663024535217be26f98d72f2a778b93a20123f7485a883af0ad80565
7949daef6d7c603e673dc01dd76282fcd2abf3fd81cea2cd6bfb0a5e1a64e29d
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c168fe749ede67d5456613fade9bbc9d7143b4c3fb1a95098a9b41c00c50822
7c3ba8bbf99673b8bbc645be8bb7c34ec4e9d2386334855a5623542dec9eab94
80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb
83735bbc6ef3247fa656770e5ba56b2732b1d019c43be56b3a26759d3f1ae663
8376431f05ed0574aa914db9f36153ed5837a067d6d3450847c49d89b37ad1bf
843ae6433eab44ef701a6a5979fb1c816173bb104242c11a186fa092bbac856f
874437e27e97a86da894c33508123bacba74c260e211d3bea4f13c3f46033db9
88d2450f3e213e8bb288a303367c2172280e33783939254f1f03a57b70065cb3
89de2f207fac8289b2b0d7300b282db8347db9f3098a30662c72ced8c199971c
9e79eaebefe9cb1188defba9413ad6d383cff1f0b4334f0b878634648fb70322
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a63540aa2a97c549fe93e0aac747a34467cd51b2fb36c4d10c4a318eff39c213
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1d292fa0d2fe96a5e8e02a95800fe7f82a7c9f9e0af627f4c10bd50e9e741b1
b3c0f4c313dd0b10df279781dc24c220d193e2837630255b77a44bd637a8f07c
b5a303d862a4eb33617dd49ff66b7765dcda2409dbe02e2953f74f21518160c8
b7aaea908b866c1619b9bf156a002c22b717a771bf22d9a2965151f9cf969670
ba65bf654556a367c0fe373354aa9023ca90726e002376dcb92410f2e9ab2c96
beb44ad388a302c67d11778d88cfbfd65a466787e5e292cbb3f785ea5f4a22d8
bef9393fcdfc7a7299c058ba2a69253c32e0964dd3e97834e17a8cdb5dce7cf6
c234d3a6e7ff0a41542220e1202ea768bffeca48680c47de404653fa040a9c7c
c73e9313bb8d3f3b1a7ce0e6fe28d8f4ecff121601d48351c206159c7c252d72
cf9b44b10a339d642ce06652810a464dec2e1f1c9e948a08142d1e65c3441cff
cfd309ec91b0036eb35802dedaffcd0976b187bd21a9a473d569ce0837913ad7
d2be23ec79b6f7809a6e75740a286ca995bc625d0d79c4a39465ff5ac702d428
d582d3d255eaba52698b1b862401f3edd8da782729b9945b177fc47c7055132f
d663fa330e3cf99b125309270bffaed504c5c487a1118d4ba5265c939dcf4cfa
d8aa84f8b7f0e4fe51f6080421619b56e2785f75bf62bd0c079256239c0c8b5e
d9094da13005a9d8089ee8514adf9eb0398a8c952b86c49a446c0e1d57f65e5a
dad84ffd0d9253b611114948f27e23fcc0022cd9f1b7ca46820459c2b7d7ddbf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fa43fd4073d3976c0bc94de0d58e6f81290443515528b60e80aa889fa38f80c2

login.newscorpaustralia.com Open in urlscan Pro 104.111.230.77 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

87 Requests

70 %HTTPS

14 %IPv6

30 Domains

40 Subdomains

26 IPs

7 Countries

2531 kBTransfer

11434 kBSize

54 Cookies

1 Outgoing links

Page URL History

Redirected requests

87 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

login.newscorpaustralia.com Open in urlscan Pro
104.111.230.77 Public Scan

Screenshot
Live screenshot

Full Image

87
Requests

70 %
HTTPS

14 %
IPv6

30
Domains

40
Subdomains

26
IPs

7
Countries

2531 kB
Transfer

11434 kB
Size

54
Cookies

87 HTTP transactions
6 data transactions