wrk4.customer1-pars4003.workers.dev Open in urlscan Pro
2606:4700:3033::6815:5250  Public Scan

URL: https://wrk4.customer1-pars4003.workers.dev/
Submission: On May 14 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 12 IPs in 2 countries across 7 domains to perform 46 HTTP transactions. The main IP is 2606:4700:3033::6815:5250, located in United States and belongs to CLOUDFLARENET, US. The main domain is wrk4.customer1-pars4003.workers.dev.
TLS certificate: Issued by E1 on May 1st 2023. Valid for: 3 months.
This is the only time wrk4.customer1-pars4003.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 2606:4700:303... 13335 (CLOUDFLAR...)
15 2a02:26f0:350... 20940 (AKAMAI-ASN1)
6 188.40.30.40 24940 (HETZNER-AS)
2 2a00:1450:400... 15169 (GOOGLE)
3 2003:8:10:2:0... 3320 (DTAG Inte...)
2 2 217.79.188.9 24961 (MYLOC-AS ...)
2 217.79.188.60 24961 (MYLOC-AS ...)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
4 91.215.103.32 43407 (INFONLINE-AS)
1 63.140.62.160 16509 (AMAZON-02)
1 2001:4860:480... 15169 (GOOGLE)
46 12
Apex Domain
Subdomains
Transfer
26 spiegel.de
cdn.prod.www.spiegel.de — Cisco Umbrella Rank: 42127
lotto.spiegel.de
data-8f03f9dd42.spiegel.de — Cisco Umbrella Rank: 116255
sams.spiegel.de — Cisco Umbrella Rank: 76274
1 MB
8 workers.dev
wrk4.customer1-pars4003.workers.dev
163 KB
4 adition.com
ad3.adfarm1.adition.com — Cisco Umbrella Rank: 62950
imagesrv.adition.com — Cisco Umbrella Rank: 17054
1 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 39
region1.google-analytics.com — Cisco Umbrella Rank: 2495
21 KB
3 matomowl.de
data.matomowl.de
64 KB
2 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 438
53 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 62
135 KB
46 7
Domain Requested by
15 cdn.prod.www.spiegel.de wrk4.customer1-pars4003.workers.dev
cdn.prod.www.spiegel.de
8 wrk4.customer1-pars4003.workers.dev wrk4.customer1-pars4003.workers.dev
6 lotto.spiegel.de wrk4.customer1-pars4003.workers.dev
4 data-8f03f9dd42.spiegel.de assets.adobedtm.com
data-8f03f9dd42.spiegel.de
3 data.matomowl.de wrk4.customer1-pars4003.workers.dev
data.matomowl.de
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 assets.adobedtm.com cdn.prod.www.spiegel.de
assets.adobedtm.com
2 imagesrv.adition.com wrk4.customer1-pars4003.workers.dev
2 ad3.adfarm1.adition.com 2 redirects
2 www.googletagmanager.com wrk4.customer1-pars4003.workers.dev
www.googletagmanager.com
1 region1.google-analytics.com www.googletagmanager.com
1 sams.spiegel.de assets.adobedtm.com
46 12
Subject Issuer Validity Valid
customer1-pars4003.workers.dev
E1
2023-05-01 -
2023-07-30
3 months crt.sh
cdn.prod.www.spiegel.de
R3
2023-03-28 -
2023-06-26
3 months crt.sh
lotto.spiegel.de
R3
2023-05-11 -
2023-08-09
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
www.matomowl.de
SwissSign RSA TLS OV ICA 2022 - 1
2023-03-22 -
2024-03-22
a year crt.sh
assets.adobedtm.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-19 -
2023-08-19
a year crt.sh
data-8f03f9dd42.spiegel.de
R3
2023-04-22 -
2023-07-21
3 months crt.sh
sams.spiegel.de
DigiCert TLS RSA SHA256 2020 CA1
2022-09-30 -
2023-10-31
a year crt.sh

This page contains 1 frames:

Primary Page: https://wrk4.customer1-pars4003.workers.dev/
Frame ID: 389D39435AE3D20253671277F948D694
Requests: 55 HTTP requests in this frame

Screenshot

Page Title

Lotto - DER SPIEGEL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

46
Requests

96 %
HTTPS

58 %
IPv6

7
Domains

12
Subdomains

12
IPs

2
Countries

1496 kB
Transfer

2731 kB
Size

12
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 24
  • https://ad3.adfarm1.adition.com/banner?sid=258099&kid=3485280&bid=10751488&wpt=C&ts=[timestamp] HTTP 302
  • https://imagesrv.adition.com/1x1.gif
Request Chain 26
  • https://ad3.adfarm1.adition.com/banner?sid=258099&kid=3485264&bid=10751464&wpt=C&ts=[timestamp] HTTP 302
  • https://imagesrv.adition.com/1x1.gif

46 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wrk4.customer1-pars4003.workers.dev/
243 KB
39 KB
Document
General
Full URL
https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:5250 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
166a3f1b19181a76726ae2cd9ad5cfd5cb751a6438572b8cd1312d7419433d64

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7c750aaa8d57910d-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sun, 14 May 2023 18:00:36 GMT
link
<https://lotto.spiegel.de/wp-json/>; rel="https://api.w.org/", <https://lotto.spiegel.de/>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DO%2BI%2BSZU71Atcj%2FkLDFN8equJHzAXjbnvM1Ayt9%2Bmt9dJ5m%2FKzh52Y1T96RpVkt%2BlecLbzcoBwS4KkM4ydeE2KaEhC0C3wXOTsKEiH6Gdm%2BYfC1%2BOwyXcoX0zrGJ72rKwxs%2F0a%2FgeSVo3sKBwCG74uKUSImHjJrS%2BNwltaPTr04oIw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
styles.75af1963f37f74e6f86b.css
cdn.prod.www.spiegel.de/public/spon/generated/css/
85 KB
15 KB
Stylesheet
General
Full URL
https://cdn.prod.www.spiegel.de/public/spon/generated/css/styles.75af1963f37f74e6f86b.css
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e119f8363dca71ddd7b64d202e52c7f801ad3a6e0bd0785dc88bf9177b7a0e41

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
gzip
akamai-cache-status
Hit from child
last-modified
Tue, 02 May 2023 09:02:10 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1682596075
etag
W/"2ea4ca1060b2dc46737cb93a96d8d68b"
vary
Accept-Encoding
content-type
text/css
cache-control
public, s-maxage=2592000, max-age=2592000
accept-ranges
bytes
content-length
15135
expires
Tue, 02 May 2023 10:06:39 GMT
commons.89c5225406a6d94f4b6b.js
cdn.prod.www.spiegel.de/public/shared/generated/js/
43 KB
12 KB
Script
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/generated/js/commons.89c5225406a6d94f4b6b.js
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5ab93a8054790e89e4ddd0bbe69d64bc6305971b3c1bcf480cd789d416b763ed

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
gzip
akamai-cache-status
Hit from child
last-modified
Tue, 02 May 2023 09:02:10 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1682596074
etag
W/"be1b83b939b9ff08291585498c3a27e1"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, s-maxage=2592000, max-age=2592000
accept-ranges
bytes
content-length
11501
expires
Tue, 02 May 2023 10:06:39 GMT
header.a51ca23e78ddd4f78db7.js
cdn.prod.www.spiegel.de/public/shared/generated/js/
7 KB
3 KB
Script
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/generated/js/header.a51ca23e78ddd4f78db7.js
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
662e92573c08cc03b51a4c229bdada4f3c73ff9bb5df8db7ef0e2102330cd043

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
gzip
akamai-cache-status
Hit from child
last-modified
Tue, 02 May 2023 09:02:10 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1682596074
etag
W/"a4454fe43a0e1e1316bfa6e2990129cd"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, s-maxage=2592000, max-age=2592000
accept-ranges
bytes
content-length
2530
expires
Tue, 02 May 2023 10:06:39 GMT
vendors.a326b0ad143942f9db48.js
cdn.prod.www.spiegel.de/public/shared/generated/js/
156 KB
48 KB
Script
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/generated/js/vendors.a326b0ad143942f9db48.js
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
11303a6adf0ac278758c5c47cfcc9f8eb4ab29200b5ca29e229b5dd554a5d693

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
gzip
akamai-cache-status
Hit from child
last-modified
Tue, 04 Apr 2023 09:00:32 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1680518664
etag
W/"846b369818357cf33ddf32ef79ea7a5b"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, s-maxage=2592000, max-age=2592000
accept-ranges
bytes
content-length
48308
expires
Tue, 04 Apr 2023 10:03:22 GMT
index.32ae2b3da27b0034a9e9.js
cdn.prod.www.spiegel.de/public/shared/generated/js/
200 KB
47 KB
Script
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/generated/js/index.32ae2b3da27b0034a9e9.js
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b7ef4fe0c0a26551134aeccf0e1c7bedb59c4c1a289e54a9d9014b8fb229becf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
gzip
akamai-cache-status
Hit from child
last-modified
Tue, 02 May 2023 09:02:10 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1682596074
etag
W/"63875428ada4c30e697aa2cfc38bf0da"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, s-maxage=2592000, max-age=2592000
accept-ranges
bytes
content-length
47618
expires
Tue, 02 May 2023 10:06:37 GMT
SpiegelSans4UI-Bold.woff2
cdn.prod.www.spiegel.de/public/shared/fonts/
39 KB
39 KB
Font
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/fonts/SpiegelSans4UI-Bold.woff2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5b65d13b2accf59d8acec406cc63ae2279aaa06dec9bd373bcec8744b6a80be5

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
akamai-cache-status
Hit from child
last-modified
Thu, 04 May 2023 10:01:19 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1683190980
etag
"b34cfff725375ac3000e39c300104028"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, s-maxage=604800, max-age=604800
accept-ranges
bytes
content-length
39692
expires
Mon, 08 May 2023 09:54:26 GMT
SpiegelSans4UI-Regular.woff2
cdn.prod.www.spiegel.de/public/shared/fonts/
38 KB
38 KB
Font
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/fonts/SpiegelSans4UI-Regular.woff2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5ae09d76b53ed5bcfa3504a4e3ef0f5cec6adb284355efb88f619d85504f2bb4

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
akamai-cache-status
Hit from child
last-modified
Thu, 04 May 2023 10:01:19 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1683190980
etag
"334ab4d3ad92620872b3cd2bd46a8b73"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, s-maxage=604800, max-age=604800
accept-ranges
bytes
content-length
38464
expires
Mon, 08 May 2023 19:03:44 GMT
SpiegelSlab4UICd-ExtraBold.woff2
cdn.prod.www.spiegel.de/public/shared/fonts/
32 KB
32 KB
Font
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/fonts/SpiegelSlab4UICd-ExtraBold.woff2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4d6c6f668fd088065d6a927c86bb45d992bcd715910c609334b5596bf3b63c4c

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
akamai-cache-status
Hit from child
last-modified
Tue, 09 May 2023 09:01:24 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1678194365
etag
"04b23c9d0b8f65be2b6c59479763e822"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, s-maxage=604800, max-age=604800
accept-ranges
bytes
content-length
32624
expires
Thu, 11 May 2023 14:46:05 GMT
SpiegelSans4-6SemiBold.woff2
cdn.prod.www.spiegel.de/public/shared/fonts/
11 KB
11 KB
Font
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/fonts/SpiegelSans4-6SemiBold.woff2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4986cfef70f57a3c524b749439a2b5b35be0f0fd2b18280dabe09bb721ce3c43

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
akamai-cache-status
Hit from child
last-modified
Thu, 04 May 2023 10:01:19 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1683190980
etag
"97e433a12662ca84b78c6e4af5506135"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, s-maxage=604800, max-age=604800
accept-ranges
bytes
content-length
11344
expires
Mon, 08 May 2023 13:20:00 GMT
SpiegelSerifTextUI-Regular.woff2
cdn.prod.www.spiegel.de/public/shared/fonts/
40 KB
40 KB
Font
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/fonts/SpiegelSerifTextUI-Regular.woff2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
c8781a2a3d250e769c7264d57b2836a9e180d5452e9212d6d51d1ea4093ffd45

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
akamai-cache-status
Hit from child
last-modified
Tue, 09 May 2023 09:01:24 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1678194365
etag
"16b1c82353e002cc9a4b3c0551788559"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, s-maxage=604800, max-age=604800
accept-ranges
bytes
content-length
40736
expires
Sat, 13 May 2023 01:04:16 GMT
SpiegelSerifTextUI-Italic.woff2
cdn.prod.www.spiegel.de/public/shared/fonts/
32 KB
33 KB
Font
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/fonts/SpiegelSerifTextUI-Italic.woff2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f90a5f8301aeffcf946f92c5059191703f269d82bdd5be8302b8cc8be963cc6a

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
akamai-cache-status
Hit from child
last-modified
Thu, 04 May 2023 10:01:19 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1683190980
etag
"dac9bba73ae7973662775fd59b233641"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, s-maxage=604800, max-age=604800
accept-ranges
bytes
content-length
33168
expires
Mon, 08 May 2023 06:00:56 GMT
SpiegelSerifTextUI-Bold.woff2
cdn.prod.www.spiegel.de/public/shared/fonts/
31 KB
31 KB
Font
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/fonts/SpiegelSerifTextUI-Bold.woff2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
813947ddc6405f4e35f985440cb938198a83d8d895a62ace5076b267b3120dc3

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
akamai-cache-status
Hit from child
last-modified
Thu, 04 May 2023 10:01:19 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1683190980
etag
"18cc1fcfdac7ee4801b8491a2dd1da3c"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, s-maxage=604800, max-age=604800
accept-ranges
bytes
content-length
31412
expires
Mon, 08 May 2023 23:21:35 GMT
SpiegelSerifTextUI-BoldItalic.woff2
cdn.prod.www.spiegel.de/public/shared/fonts/
33 KB
33 KB
Font
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/fonts/SpiegelSerifTextUI-BoldItalic.woff2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
c8021c17932ea41e5e8fd0db9af0202110f5156eab8f2473eb2eb3e650c5e2d0

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
akamai-cache-status
Hit from child
last-modified
Tue, 09 May 2023 09:01:24 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1678194365
etag
"c1d259b6279a6ea9254d57aa92d9fb77"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, s-maxage=604800, max-age=604800
accept-ranges
bytes
content-length
33816
expires
Thu, 11 May 2023 03:22:57 GMT
SpiegelSerifDisplayUI-BoldItalic.woff2
cdn.prod.www.spiegel.de/public/shared/fonts/
33 KB
34 KB
Font
General
Full URL
https://cdn.prod.www.spiegel.de/public/shared/fonts/SpiegelSerifDisplayUI-BoldItalic.woff2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
c931dec2166efa07832b7cdb52ff3e3f00ffe7a3c3563b4db8b762a1e096a08e

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
akamai-cache-status
Hit from child
last-modified
Tue, 09 May 2023 09:01:24 GMT
x-ttl
86400.000
x-cache-grace
3600.000
x-goog-meta-goog-reserved-file-mtime
1678194365
etag
"882c0a05482c2c0eb186726fdab46113"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, s-maxage=604800, max-age=604800
accept-ranges
bytes
content-length
34256
expires
Wed, 10 May 2023 10:55:03 GMT
head.min.js
wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/js/
237 B
525 B
Script
General
Full URL
https://wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/js/head.min.js
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:5250 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55e9b21d347d9b9e249ff173b88790bf6f420f064e66243ce7abd010b017c81d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 24 Aug 2020 14:27:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MI2jxyhEWO2ODbXR43g8TH9SKaKVi%2F%2Bi73uf6F9FP4VMrFBhwXtk5UYliMiNyGHSaK3qu6aewENHSnL09mWqFfvIFsBmQEmHC5I%2Fjf6EQXC2u6bZG%2FEZOoMurAONTSZgtV3iz5MjvpQQ2TGurbdAIOWEaT%2BcckuRVDIWe00u%2BpN8Sw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7c750aae894e910d-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
main.min.css
wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/css/
75 KB
13 KB
Stylesheet
General
Full URL
https://wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/css/main.min.css?v=1
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:5250 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcf59475fbdd87a6cdc46fb231485a6ff706fcd0484a5bae12edd9a63330fff5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 23 Oct 2020 07:43:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5%2BqjdIjKlDUGoeKkrmhQMsMV%2FGfzvUugpgzFd4Umb%2FaOvvxLuxbCxq3qrZRTGqYhXEbWLugGCqb3Ymc5h6dZxJiPAJUd15SBxv4Duz0Rg9xJFdUchJG2xceVZnjD8YhqAjhxZmPZSPbrS%2B6w7VxZnK1%2FKnt0hKx3XNglnVYTAOY7Jw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7c750aae8951910d-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.min.css
lotto.spiegel.de/wp/wp-includes/css/dist/block-library/
52 KB
8 KB
Stylesheet
General
Full URL
https://lotto.spiegel.de/wp/wp-includes/css/dist/block-library/style.min.css?ver=5.4.2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
188.40.30.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
www474.your-server.de
Software
Apache /
Resource Hash
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
gzip
last-modified
Wed, 10 Jun 2020 21:41:09 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
7642
style.css
lotto.spiegel.de/app/themes/lotto-theme/
908 B
670 B
Stylesheet
General
Full URL
https://lotto.spiegel.de/app/themes/lotto-theme/style.css?ver=5.4.2
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
188.40.30.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
www474.your-server.de
Software
Apache /
Resource Hash
37ed781f0f74baa5ad5f117685760508acd8adf8d42beca400c3c28871ab9d25

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
gzip
last-modified
Mon, 10 Aug 2020 17:50:51 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
555
logoLotto.png
lotto.spiegel.de/app/uploads/2020/01/
3 KB
3 KB
Image
General
Full URL
https://lotto.spiegel.de/app/uploads/2020/01/logoLotto.png
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
188.40.30.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
www474.your-server.de
Software
Apache /
Resource Hash
f3e457ec10a36add2324d31474965ff1359fbbff84774bf3ec7b4f4c7e648584

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
last-modified
Tue, 14 Jan 2020 09:52:12 GMT
server
Apache
accept-ranges
bytes
content-length
2600
content-type
image/png
Eurojackpot_image_big_desktop-1.png
lotto.spiegel.de/app/uploads/2020/01/
156 KB
156 KB
Image
General
Full URL
https://lotto.spiegel.de/app/uploads/2020/01/Eurojackpot_image_big_desktop-1.png
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
188.40.30.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
www474.your-server.de
Software
Apache /
Resource Hash
7c53c4b35540dd48c9bd33207d61e5530ec91cbc541a6b5e0dc04f829fbda31c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
last-modified
Thu, 23 Jan 2020 16:21:40 GMT
server
Apache
accept-ranges
bytes
content-length
159689
content-type
image/png
Lotto_6aus49_mobile.png
lotto.spiegel.de/app/uploads/2020/01/
170 KB
170 KB
Image
General
Full URL
https://lotto.spiegel.de/app/uploads/2020/01/Lotto_6aus49_mobile.png
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
188.40.30.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
www474.your-server.de
Software
Apache /
Resource Hash
313da645d1240edf95d35aeafa6d279f0c673412e5384c0e8b3371873811dc8d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
last-modified
Mon, 13 Jan 2020 14:56:53 GMT
server
Apache
accept-ranges
bytes
content-length
174207
content-type
image/png
Gluecksspirale_mobile.png
lotto.spiegel.de/app/uploads/2020/01/
276 KB
277 KB
Image
General
Full URL
https://lotto.spiegel.de/app/uploads/2020/01/Gluecksspirale_mobile.png
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
188.40.30.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
www474.your-server.de
Software
Apache /
Resource Hash
6bdddb8f435f5d599572985198137b53029fa4a99415e4e0afb2cdc1911676a0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
last-modified
Mon, 13 Jan 2020 14:56:06 GMT
server
Apache
accept-ranges
bytes
content-length
283042
content-type
image/png
js
www.googletagmanager.com/gtag/
170 KB
62 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-157377436-1
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
167e8fdeea57495e5fefc5a5649a44f2dd08514d6910066801088d40bdd7d801
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
63193
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sun, 14 May 2023 18:00:37 GMT
matomo.php
data.matomowl.de/piwik/
43 B
651 B
Image
General
Full URL
https://data.matomowl.de/piwik/matomo.php?idsite=17&rec=1
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2003:8:10:2:0:a10:af16:3d2e , Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software
WestLotto / PHP/8.0.27
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Sun, 14 May 2023 18:00:37 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Server
WestLotto
X-Powered-By
PHP/8.0.27
Expect-CT
enforce, max-age=3600, report-uri="https://1934a11189c9ec9d302de0ee10e4c650.report-uri.com/r/t/ct/enforce"
Vary
User-Agent
Transfer-Encoding
chunked
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
X-Xss-Protection
1; mode=block
1x1.gif
imagesrv.adition.com/
Redirect Chain
  • https://ad3.adfarm1.adition.com/banner?sid=258099&kid=3485280&bid=10751488&wpt=C&ts=[timestamp]
  • https://imagesrv.adition.com/1x1.gif
68 B
178 B
Image
General
Full URL
https://imagesrv.adition.com/1x1.gif
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Server
217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
imagesrv.adition.com
Software
/
Resource Hash
5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sun, 14 May 2023 18:00:37 GMT
last-modified
Fri, 24 Jul 2009 13:46:10 GMT
accept-ranges
bytes
etag
"3122740758"
content-length
68
content-type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 14 May 2023 20:00:37 +0200
server
ADITIONSERVER v1.0
etag
7233099602249254105
content-type
text/plain
location
https://imagesrv.adition.com/1x1.gif
access-control-allow-origin
*
p3p
policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
cache-control
no-cache
expires
Sat, 01 Jan 2000 00:00:00 GMT
icon-close.svg
wrk4.customer1-pars4003.workers.dev/assets/images/
1 KB
1 KB
Image
General
Full URL
https://wrk4.customer1-pars4003.workers.dev/assets/images/icon-close.svg
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::6815:5250 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4252403b5990b1da22ea5f49bf62a4f4b8335a2ac8681ececdb2ab313781ae2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 24 Aug 2020 14:24:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DebhgN92Pvn2cOC09RJ2oO8NuzxnFQ0VkuLaxw3OZRntlG16Pp5f%2F%2FFSsWZGFyG1XeWkp%2Bz%2BOG7ciejk1AAMnS0w3EWN9kuJyo%2Bb748Sq74LNmG6ZRBTRDd0VVn1NNh2JEWZn2DzF8hPzjuxguWSdJ7kqRkwiePv8oac2QN8tH5djg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400
cf-ray
7c750aaf1b4f39c7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
1x1.gif
imagesrv.adition.com/
Redirect Chain
  • https://ad3.adfarm1.adition.com/banner?sid=258099&kid=3485264&bid=10751464&wpt=C&ts=[timestamp]
  • https://imagesrv.adition.com/1x1.gif
68 B
103 B
Image
General
Full URL
https://imagesrv.adition.com/1x1.gif
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H2
Server
217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
imagesrv.adition.com
Software
/
Resource Hash
5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sun, 14 May 2023 18:00:37 GMT
last-modified
Fri, 24 Jul 2009 13:46:10 GMT
accept-ranges
bytes
etag
"3122740758"
content-length
68
content-type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 14 May 2023 20:00:37 +0200
server
ADITIONSERVER v1.0
etag
7233099602249319641
content-type
text/plain
location
https://imagesrv.adition.com/1x1.gif
access-control-allow-origin
*
p3p
policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
cache-control
no-cache
expires
Sat, 01 Jan 2000 00:00:00 GMT
email-decode.min.js
wrk4.customer1-pars4003.workers.dev/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://wrk4.customer1-pars4003.workers.dev/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::6815:5250 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 10 May 2023 14:15:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"645ba6ec-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uePi8t%2F2ORL7mvIk2QwaWZ%2F02un%2FsQThMXy9NAVF32rYDWG9KRO3uF8yCnBJUgJeg3CmhLUMD5RV3L1dc9DhRrhzeB9TTJqbN5tPjZZjuc6yxJQwoQC7khSZ7Q%2FywTAB6ghB7n8BC1WqcQT3BPIWclb6l32PdvyNFAnWymgyPSlKbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
7c750aaf1b4939c7-FRA
expires
Tue, 16 May 2023 18:00:36 GMT
main.min.js
wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/js/
170 KB
55 KB
Script
General
Full URL
https://wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/js/main.min.js
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::6815:5250 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe6460a40b4cd37921f53fe710a9750d3a5da188a558ec8c00c003dc29c57b31

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 18 Jan 2023 13:13:32 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FK7YmszGtfhAHdLhXOjo5My4Y6kZEd5TXU6fShq6k95dNhIqz9ks2fotySO7tT43VYvRsO%2BGb4o3r42hhH4VDW%2Ft1GEfCWeaaOFamUKFi178B2AGlp85r%2BYGXH%2B%2BkFSIO2SjAK5SqD3V0xi8hmo9NyUD%2FFwuCzAya5d%2BlPwlzCwzXw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7c750aaf1b4e39c7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
matomo.js
data.matomowl.de/piwik/
62 KB
63 KB
Script
General
Full URL
https://data.matomowl.de/piwik/matomo.js
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2003:8:10:2:0:a10:af16:3d2e , Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software
WestLotto /
Resource Hash
0ce713b6cef25179719f242dcfa4ed9e985f1443257722299df2768deeb5ab6e
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Sun, 14 May 2023 18:00:37 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
63675
X-Xss-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 16 Nov 2021 07:20:23 GMT
Server
WestLotto
ETag
"f8bb-5d0e2c2351bc0"
Expect-CT
enforce, max-age=3600, report-uri="https://1934a11189c9ec9d302de0ee10e4c650.report-uri.com/r/t/ct/enforce"
Vary
User-Agent
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
must-revalidate
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
p22r_woff.woff
wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/fonts//
28 KB
28 KB
Font
General
Full URL
https://wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/fonts//p22r_woff.woff
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/css/main.min.css?v=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::6815:5250 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ddb42b1f99026383d2de5f2e825de8239e5b4e6ae9f166487892a14b3fc5e024

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/css/main.min.css?v=1
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
cf-cache-status
MISS
last-modified
Mon, 24 Aug 2020 14:24:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qIYE63nBlolbG52bQ7FOOeJ1nSh9Xvt%2FR%2BlTquLIkKoUuBhjawj8mMTbo8tEjb3DbRl9p%2FXyENnDBlHm4YKHUBYtdb5hMHjx5ndgjq9pKBZm2FT3QlmJJPbejOsovwIdDFy3VmDpgnqpQqFnzrUurJG66hVPLFO0JlY3PGtUj%2BrgLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7c750aaf5b9b39c7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
28196
aachenw01_woff.woff
wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/fonts//
24 KB
25 KB
Font
General
Full URL
https://wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/fonts//aachenw01_woff.woff
Requested by
Host: wrk4.customer1-pars4003.workers.dev
URL: https://wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/css/main.min.css?v=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::6815:5250 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d31b7812e272130080e50e9117710e1cf75c443a397bc4bf8ee2f0b00fe6765

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/assets/brands/eurojackpot/css/main.min.css?v=1
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
cf-cache-status
MISS
last-modified
Mon, 24 Aug 2020 14:24:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X%2FwzxTV0%2BHfXOqj8nzttyFPuF0WLnHiAv%2BIcNPRdCebN0ADDYmS%2FKzZoSf2TdHVEA15ZfxChU%2FWFf7FwauLphf%2FBuwQKwlBLVXJc5Awy5D3W1fdTnyMzTm67GcbGDLR6BO2Uo9qTFR%2Ft8HAU6uxsRdsWA1SjnM6%2B8h1r27wRKwYKaA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7c750aaf5ba439c7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
24764
truncated
/
90 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
10ff0d60bfd122c6111c16a95dce08e3ac4c0c2625e9dc89df5fc1bfc20fffa3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
92 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e09a6503c57a0be3f26fac96c29875c60fa5bb4570f9a284c440c36129d64c00

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
90 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e34e3767438924f7a921fe6e947f831717a0f9905343f5941b2fb108fe8762d9

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
94 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
08c1caa3c9865973b486795b763065327d37f241e30f43064f7779c45560a814

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
94 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0f27bf250b76a9086dab149430370668a431e1ec8dfc28d1e91662a24fc6e3d9

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
94 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9f1dcff795fb3edeb001c9e566ccb85edfc7e174cd0cc0e4d05766bd534eb2a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
94 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ff3e82c0365229a9f962f063a601da8eee495129132628a8a9c5a6e13eab98ce

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
90 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
560264c04c8234afbce89f4b26d6009ee64d5d18cad14992f9a473fee1ec152c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
90 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
624aa195716c9815c3236f3fef49383dbced2596c7430bb4069ec4e323e30239

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
90 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
331d866a911b6978849e8239e720b1e82e43014aadb74978cab4e5d3b2b78671

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
breakingnews.json
cdn.prod.www.spiegel.de/assets/news/
2 B
197 B
Fetch
General
Full URL
https://cdn.prod.www.spiegel.de/assets/news/breakingnews.json
Requested by
Host: cdn.prod.www.spiegel.de
URL: https://cdn.prod.www.spiegel.de/public/shared/generated/js/index.32ae2b3da27b0034a9e9.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:11::215:14da Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
gzip
akamai-cache-status
Hit from child
x-cache-grace
3600.000
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public,max-age=30,s-maxage=30
accept-ranges
bytes
content-length
22
launch-0fa706680a4c.min.js
assets.adobedtm.com/cc10f7b4369d/8a7c25aee284/
177 KB
53 KB
Script
General
Full URL
https://assets.adobedtm.com/cc10f7b4369d/8a7c25aee284/launch-0fa706680a4c.min.js
Requested by
Host: cdn.prod.www.spiegel.de
URL: https://cdn.prod.www.spiegel.de/public/shared/generated/js/index.32ae2b3da27b0034a9e9.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
3a5884a4edf271ab8aafe500848fc61264dd9a8cf27d2fcca26e87539c0b20d0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
gzip
last-modified
Wed, 12 Apr 2023 13:31:17 GMT
server
AkamaiNetStorage
etag
"d775e47829a54ff2c5fc336309cb0481:1681306277.796972"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://wrk4.customer1-pars4003.workers.dev
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
53518
expires
Sun, 14 May 2023 19:00:37 GMT
js
www.googletagmanager.com/gtag/
202 KB
72 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-F9S5JVG7ZF&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-157377436-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e78fdd28d40ed5052a26bc6ce659ad8bae5b9d3f8e705e893dc0358d9a6b5f22
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
74073
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sun, 14 May 2023 18:00:37 GMT
analytics.js
www.google-analytics.com/
51 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-157377436-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sun, 14 May 2023 17:05:00 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
3337
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Sun, 14 May 2023 19:05:00 GMT
matomo.php
data.matomowl.de/piwik/
0
567 B
Ping
General
Full URL
https://data.matomowl.de/piwik/matomo.php?action_name=Lotto%20-%20DER%20SPIEGEL&idsite=17&rec=1&r=179477&h=18&m=0&s=37&url=https%3A%2F%2Fwrk4.customer1-pars4003.workers.dev%2F&_id=2a616d47ef1c12d7&_idn=1&_refts=0&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=sLJAMl&pf_net=59&pf_srv=629&pf_tfr=9&pf_dm1=355
Requested by
Host: data.matomowl.de
URL: https://data.matomowl.de/piwik/matomo.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2003:8:10:2:0:a10:af16:3d2e , Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software
WestLotto / PHP/8.0.27
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8

Response headers

Date
Sun, 14 May 2023 18:00:37 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Server
WestLotto
X-Powered-By
PHP/8.0.27
Expect-CT
enforce, max-age=3600, report-uri="https://1934a11189c9ec9d302de0ee10e4c650.report-uri.com/r/t/ct/enforce"
Vary
User-Agent
Access-Control-Allow-Origin
*
Cache-Control
must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
X-Xss-Protection
1; mode=block
bundle.js
data-8f03f9dd42.spiegel.de/iomm/latest/manager/base/es6/
62 KB
19 KB
Script
General
Full URL
https://data-8f03f9dd42.spiegel.de/iomm/latest/manager/base/es6/bundle.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cc10f7b4369d/8a7c25aee284/launch-0fa706680a4c.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.215.103.32 , Germany, ASN43407 (INFONLINE-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
fb969ef87a117b61dc514bca5e2f6b263a809c31cc2743d129086132806c20bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
gzip
last-modified
Wed, 10 May 2023 09:22:44 GMT
server
nginx
etag
W/"645b6264-f75b"
vary
Accept-Encoding, Origin
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public, must-revalidate
x-robots-tag
noindex, nofollow, nosnippet, noarchive
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookies,X-Robots-Tag
expires
Mon, 15 May 2023 18:00:37 GMT
RCcbfbfc0269cd4dd1a23e433ef4bda8a8-source.min.js
assets.adobedtm.com/cc10f7b4369d/8a7c25aee284/1a0c11d57498/
298 B
463 B
Script
General
Full URL
https://assets.adobedtm.com/cc10f7b4369d/8a7c25aee284/1a0c11d57498/RCcbfbfc0269cd4dd1a23e433ef4bda8a8-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cc10f7b4369d/8a7c25aee284/launch-0fa706680a4c.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
e2479bf2a099f23ca31f2c194e59d4146952772eac02780123433c803c4fa0aa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
gzip
last-modified
Wed, 12 Apr 2023 13:31:18 GMT
server
AkamaiNetStorage
etag
"05092bed4b79b08bcfb406105f907dd4:1681306278.55745"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://wrk4.customer1-pars4003.workers.dev
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
184
expires
Sun, 14 May 2023 19:00:37 GMT
interact
sams.spiegel.de/ee/v1/
731 B
837 B
Fetch
General
Full URL
https://sams.spiegel.de/ee/v1/interact?configId=8d39d11f-1f25-4291-9087-f24bb9802bd0&requestId=360db6bb-5721-4f94-9ce3-1049529f6ef4
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cc10f7b4369d/8a7c25aee284/launch-0fa706680a4c.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.140.62.160 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-63-140-62-160.data.adobedc.net
Software
jag /
Resource Hash
9117e21069e1b21cdbb739569df8d112ab67571778e3c35bdf08fac56f970cc3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
text/plain; charset=UTF-8

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
deflate
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
x-rate-limit-remaining
599
x-adobe-edge
IRL1;6
x-xss-protection
1; mode=block
x-request-id
360db6bb-5721-4f94-9ce3-1049529f6ef4
server
jag
vary
Origin
content-type
application/json;charset=utf-8
access-control-allow-origin
https://wrk4.customer1-pars4003.workers.dev
access-control-expose-headers
Retry-After, X-Adobe-Edge, X-Request-ID
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
x-konductor
23.5.21:b885e648
collect
region1.google-analytics.com/g/
0
268 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-F9S5JVG7ZF&gtm=45je35a0&_p=1232849188&cid=1691233924.1684087237&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1684087237&sct=1&seg=0&dl=https%3A%2F%2Fwrk4.customer1-pars4003.workers.dev%2F&dt=Lotto%20-%20DER%20SPIEGEL&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-F9S5JVG7ZF&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wrk4.customer1-pars4003.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 14 May 2023 18:00:37 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://wrk4.customer1-pars4003.workers.dev
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
1 B
220 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=1232849188&t=pageview&_s=1&dl=https%3A%2F%2Fwrk4.customer1-pars4003.workers.dev%2F&ul=en-us&de=UTF-8&dt=Lotto%20-%20DER%20SPIEGEL&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1818762902&gjid=309655585&cid=1691233924.1684087237&tid=UA-157377436-1&_gid=1689593245.1684087237&_r=1&gtm=457e35a0&jsscut=1&z=1685698228
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 14 May 2023 18:00:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://wrk4.customer1-pars4003.workers.dev
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
bundle.js
data-8f03f9dd42.spiegel.de/iomb/latest/sensor/manager/base/es6/
26 KB
10 KB
Script
General
Full URL
https://data-8f03f9dd42.spiegel.de/iomb/latest/sensor/manager/base/es6/bundle.js
Requested by
Host: data-8f03f9dd42.spiegel.de
URL: https://data-8f03f9dd42.spiegel.de/iomm/latest/manager/base/es6/bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.215.103.32 , Germany, ASN43407 (INFONLINE-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
d46b45450021ae5e04125b8b529b465cf8ccad11bf6acfa1c4cca244ef77ef6f

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
Origin
https://wrk4.customer1-pars4003.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
gzip
last-modified
Wed, 06 Jul 2022 10:13:46 GMT
server
nginx
etag
W/"62c5605a-681d"
vary
Accept-Encoding, Origin
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
https://wrk4.customer1-pars4003.workers.dev
cache-control
max-age=86400, public, must-revalidate
x-robots-tag
noindex, nofollow, nosnippet, noarchive
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookies,X-Robots-Tag
expires
Mon, 15 May 2023 18:00:37 GMT
base.io
data-8f03f9dd42.spiegel.de/
0
347 B
XHR
General
Full URL
https://data-8f03f9dd42.spiegel.de/base.io
Requested by
Host: data-8f03f9dd42.spiegel.de
URL: https://data-8f03f9dd42.spiegel.de/iomb/latest/sensor/manager/base/es6/bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.215.103.32 , Germany, ASN43407 (INFONLINE-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://wrk4.customer1-pars4003.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

date
Sun, 14 May 2023 18:00:37 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding, Accept-Encoding, Origin
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://wrk4.customer1-pars4003.workers.dev
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookies
base.io
data-8f03f9dd42.spiegel.de/
0
0
Preflight
General
Full URL
https://data-8f03f9dd42.spiegel.de/base.io
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.215.103.32 , Germany, ASN43407 (INFONLINE-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://wrk4.customer1-pars4003.workers.dev
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookies
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://wrk4.customer1-pars4003.workers.dev
access-control-max-age
1728000
date
Sun, 14 May 2023 18:00:37 GMT
server
nginx
vary
Origin

Verdicts & Comments Add Verdict or Comment

43 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| event boolean| credentialless undefined| match undefined| minVersion undefined| version undefined| ua undefined| isOSSupported boolean| isBrowserSupported object| webpackJsonp object| SARAs_data object| polygon object| GujAd object| GujAdPositions object| mrm function| gtag object| dataLayer object| _paq boolean| videoId object| picturefillCFG function| picturefill object| app function| overlayOn function| overlayOff object| privacyManagerLinks object| Alpine number| lastVolume object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log object| _satellite boolean| __satelliteLoaded function| alloy string| IOMmGlobalObject function| IOMm object| gaGlobal object| gaplugins object| gaData object| iom

12 Cookies

Domain/Path Name / Value
.adfarm1.adition.com/ Name: lv_3485280
Value: w=258099|t=1684087236
.adfarm1.adition.com/ Name: UserID1
Value: 7233099602249188569
.adfarm1.adition.com/ Name: lv_3485264
Value: w=258099|t=1684087236
wrk4.customer1-pars4003.workers.dev/ Name: _pk_id.17.0aff
Value: 2a616d47ef1c12d7.1684087237.
wrk4.customer1-pars4003.workers.dev/ Name: _pk_ses.17.0aff
Value: 1
.customer1-pars4003.workers.dev/ Name: _ga_F9S5JVG7ZF
Value: GS1.1.1684087237.1.0.1684087237.0.0.0
.customer1-pars4003.workers.dev/ Name: _ga
Value: GA1.3.1691233924.1684087237
.customer1-pars4003.workers.dev/ Name: _gid
Value: GA1.3.1689593245.1684087237
.customer1-pars4003.workers.dev/ Name: _gat_gtag_UA_157377436_1
Value: 1
.customer1-pars4003.workers.dev/ Name: kndctr_79655FCF5C1D42160A495E15_AdobeOrg_cluster
Value: irl1
.customer1-pars4003.workers.dev/ Name: kndctr_79655FCF5C1D42160A495E15_AdobeOrg_identity
Value: CiY1MTM1NzcwODQ1NDc0NzM0OTAwMDc3NjgxMTgwMzgyMzI0NDcwM1IRCNjWr9uBMRABGAEqBElSTDHwAdjWr9uBMQ==
.customer1-pars4003.workers.dev/ Name: AMCV_79655FCF5C1D42160A495E15%40AdobeOrg
Value: MCMID|51357708454747349000776811803823244703

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad3.adfarm1.adition.com
assets.adobedtm.com
cdn.prod.www.spiegel.de
data-8f03f9dd42.spiegel.de
data.matomowl.de
imagesrv.adition.com
lotto.spiegel.de
region1.google-analytics.com
sams.spiegel.de
wrk4.customer1-pars4003.workers.dev
www.google-analytics.com
www.googletagmanager.com
188.40.30.40
2001:4860:4802:32::36
2003:8:10:2:0:a10:af16:3d2e
217.79.188.60
217.79.188.9
2606:4700:3033::6815:5250
2a00:1450:4001:82b::200e
2a00:1450:4001:82f::2008
2a02:26f0:3500:11::215:14da
2a02:26f0:3500:591::1e80
63.140.62.160
91.215.103.32
08c1caa3c9865973b486795b763065327d37f241e30f43064f7779c45560a814
0ce713b6cef25179719f242dcfa4ed9e985f1443257722299df2768deeb5ab6e
0f27bf250b76a9086dab149430370668a431e1ec8dfc28d1e91662a24fc6e3d9
10ff0d60bfd122c6111c16a95dce08e3ac4c0c2625e9dc89df5fc1bfc20fffa3
11303a6adf0ac278758c5c47cfcc9f8eb4ab29200b5ca29e229b5dd554a5d693
166a3f1b19181a76726ae2cd9ad5cfd5cb751a6438572b8cd1312d7419433d64
167e8fdeea57495e5fefc5a5649a44f2dd08514d6910066801088d40bdd7d801
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
313da645d1240edf95d35aeafa6d279f0c673412e5384c0e8b3371873811dc8d
331d866a911b6978849e8239e720b1e82e43014aadb74978cab4e5d3b2b78671
37ed781f0f74baa5ad5f117685760508acd8adf8d42beca400c3c28871ab9d25
3a5884a4edf271ab8aafe500848fc61264dd9a8cf27d2fcca26e87539c0b20d0
4986cfef70f57a3c524b749439a2b5b35be0f0fd2b18280dabe09bb721ce3c43
4d6c6f668fd088065d6a927c86bb45d992bcd715910c609334b5596bf3b63c4c
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55e9b21d347d9b9e249ff173b88790bf6f420f064e66243ce7abd010b017c81d
560264c04c8234afbce89f4b26d6009ee64d5d18cad14992f9a473fee1ec152c
5ab93a8054790e89e4ddd0bbe69d64bc6305971b3c1bcf480cd789d416b763ed
5ae09d76b53ed5bcfa3504a4e3ef0f5cec6adb284355efb88f619d85504f2bb4
5b65d13b2accf59d8acec406cc63ae2279aaa06dec9bd373bcec8744b6a80be5
5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c
624aa195716c9815c3236f3fef49383dbced2596c7430bb4069ec4e323e30239
662e92573c08cc03b51a4c229bdada4f3c73ff9bb5df8db7ef0e2102330cd043
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bdddb8f435f5d599572985198137b53029fa4a99415e4e0afb2cdc1911676a0
7c53c4b35540dd48c9bd33207d61e5530ec91cbc541a6b5e0dc04f829fbda31c
813947ddc6405f4e35f985440cb938198a83d8d895a62ace5076b267b3120dc3
9117e21069e1b21cdbb739569df8d112ab67571778e3c35bdf08fac56f970cc3
9d31b7812e272130080e50e9117710e1cf75c443a397bc4bf8ee2f0b00fe6765
b7ef4fe0c0a26551134aeccf0e1c7bedb59c4c1a289e54a9d9014b8fb229becf
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
c8021c17932ea41e5e8fd0db9af0202110f5156eab8f2473eb2eb3e650c5e2d0
c8781a2a3d250e769c7264d57b2836a9e180d5452e9212d6d51d1ea4093ffd45
c931dec2166efa07832b7cdb52ff3e3f00ffe7a3c3563b4db8b762a1e096a08e
d4252403b5990b1da22ea5f49bf62a4f4b8335a2ac8681ececdb2ab313781ae2
d46b45450021ae5e04125b8b529b465cf8ccad11bf6acfa1c4cca244ef77ef6f
d9f1dcff795fb3edeb001c9e566ccb85edfc7e174cd0cc0e4d05766bd534eb2a
ddb42b1f99026383d2de5f2e825de8239e5b4e6ae9f166487892a14b3fc5e024
e09a6503c57a0be3f26fac96c29875c60fa5bb4570f9a284c440c36129d64c00
e119f8363dca71ddd7b64d202e52c7f801ad3a6e0bd0785dc88bf9177b7a0e41
e2479bf2a099f23ca31f2c194e59d4146952772eac02780123433c803c4fa0aa
e34e3767438924f7a921fe6e947f831717a0f9905343f5941b2fb108fe8762d9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e78fdd28d40ed5052a26bc6ce659ad8bae5b9d3f8e705e893dc0358d9a6b5f22
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
f3e457ec10a36add2324d31474965ff1359fbbff84774bf3ec7b4f4c7e648584
f90a5f8301aeffcf946f92c5059191703f269d82bdd5be8302b8cc8be963cc6a
fb969ef87a117b61dc514bca5e2f6b263a809c31cc2743d129086132806c20bf
fcf59475fbdd87a6cdc46fb231485a6ff706fcd0484a5bae12edd9a63330fff5
fe6460a40b4cd37921f53fe710a9750d3a5da188a558ec8c00c003dc29c57b31
ff3e82c0365229a9f962f063a601da8eee495129132628a8a9c5a6e13eab98ce