urlscan.io logo urlscan.io
SecurityTrails logo

www.theepochtimes.com Open in urlscan Pro
2606:4700::6811:9d16  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Submission: On November 29 via manual from TR — Scanned from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 125 IPs in 11 countries across 130 domains to perform 562 HTTP transactions. The main IP is 2606:4700::6811:9d16, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.theepochtimes.com. The Cisco Umbrella rank of the primary domain is 45532.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 18th 2023. Valid for: a year.
This is the only time www.theepochtimes.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
45 2606:4700::68... 13335 (CLOUDFLAR...)
5 108.138.26.75 16509 (AMAZON-02)
1 2a04:4e42:800... 54113 (FASTLY)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
10 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
29 34.102.198.207 396982 (GOOGLE-CL...)
12 2606:4700:e6:... 13335 (CLOUDFLAR...)
7 66.6.101.151 11320 (LIGHTEDGE...)
3 34.110.129.224 396982 (GOOGLE-CL...)
5 52.30.181.208 16509 (AMAZON-02)
1 12 51.89.9.252 16276 (OVH)
6 52.210.49.96 16509 (AMAZON-02)
5 18.173.154.40 16509 (AMAZON-02)
5 107.22.251.49 14618 (AMAZON-AES)
23 34.120.33.89 396982 (GOOGLE-CL...)
3 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
5 2001:4860:480... 15169 (GOOGLE)
1 6 2a00:1450:400... 15169 (GOOGLE)
4 4.7.168.74 3356 (LEVEL3)
1 4 2a00:1450:400... 15169 (GOOGLE)
3 2a04:4e42::645 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
1 23.45.238.53 16625 (AKAMAI-AS)
1 51 18.173.187.86 16509 (AMAZON-02)
1 2606:4700:e2:... 13335 (CLOUDFLAR...)
5 2.19.198.122 20940 (AKAMAI-ASN1)
2 151.101.66.133 54113 (FASTLY)
5 2a00:1450:400... 15169 (GOOGLE)
4 99.84.93.134 16509 (AMAZON-02)
1 44.219.140.141 14618 (AMAZON-AES)
1 2606:4700::68... 13335 (CLOUDFLAR...)
6 2a00:1450:400... 15169 (GOOGLE)
1 142.250.186.98 15169 (GOOGLE)
1 52.92.178.24 16509 (AMAZON-02)
4 2400:52e0:1e0... 200325 (BUNNYCDN)
1 2a00:1450:400... 15169 (GOOGLE)
1 23.45.238.237 16625 (AKAMAI-AS)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a04:4e42:400... 54113 (FASTLY)
2 54.228.144.102 16509 (AMAZON-02)
2 2a03:2880:f08... 32934 (FACEBOOK)
3 66.6.101.188 11320 (LIGHTEDGE...)
1 34.249.188.76 16509 (AMAZON-02)
5 18.173.154.79 16509 (AMAZON-02)
1 18.66.192.26 16509 (AMAZON-02)
1 108.138.36.128 16509 (AMAZON-02)
2 52.30.187.221 16509 (AMAZON-02)
1 2a03:2880:f17... 32934 (FACEBOOK)
9 2a00:1450:400... 15169 (GOOGLE)
10 40 104.18.36.155 13335 (CLOUDFLAR...)
5 5 23.56.202.187 16625 (AKAMAI-AS)
10 23.35.229.251 16625 (AKAMAI-AS)
10 10 35.244.159.8 15169 (GOOGLE)
38 99.84.88.111 16509 (AMAZON-02)
27 27 3.71.149.231 16509 (AMAZON-02)
13 35.71.131.137 16509 (AMAZON-02)
37 69 69.173.144.165 26667 (RUBICONPR...)
15 15 198.47.127.18 62713 (AS-PUBMATIC)
17 19 142.250.185.226 15169 (GOOGLE)
5 5 185.64.191.210 62713 (AS-PUBMATIC)
5 5 198.47.127.20 3257 (GTT-BACKB...)
11 11 98.98.134.243 21859 (ZEN-ECN)
10 10 54.170.64.73 16509 (AMAZON-02)
11 12 34.111.113.62 396982 (GOOGLE-CL...)
2 54.85.57.117 14618 (AMAZON-AES)
5 18.200.44.133 16509 (AMAZON-02)
13 13 52.22.32.84 14618 (AMAZON-AES)
5 5 178.250.1.9 44788 (ASN-CRITE...)
5 2600:1f18:ed:... 14618 (AMAZON-AES)
4 9 52.46.155.104 16509 (AMAZON-02)
2 72.251.241.196 32475 (SINGLEHOP...)
2 2 193.0.160.130 54312 (ROCKETFUEL)
3 3 50.31.142.223 22075 (AS-OUTBRAIN)
2 2 34.96.71.22 396982 (GOOGLE-CL...)
3 4 185.86.139.104 201081 (SMARTADSE...)
2 4 2620:116:800d... 16509 (AMAZON-02)
3 3 151.101.66.49 54113 (FASTLY)
5 5 3.124.253.58 16509 (AMAZON-02)
4 4 54.198.207.123 14618 (AMAZON-AES)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2a05:d018:cc3... 16509 (AMAZON-02)
1 2 35.214.210.123 15169 (GOOGLE)
2 2 134.122.57.34 14061 (DIGITALOC...)
1 1 2600:1f18:730... 14618 (AMAZON-AES)
1 35.168.179.116 14618 (AMAZON-AES)
2 2 185.184.8.90 204995 (RTB-HOUSE...)
2 2 13.248.245.213 16509 (AMAZON-02)
1 63.251.14.14 14744 (INTERNAP-...)
2 2 208.93.169.131 46244 (WEBMD-IDC...)
8 13 69.173.144.139 26667 (RUBICONPR...)
1 1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2 2606:4700:20:... 13335 (CLOUDFLAR...)
1 4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 4 52.202.83.199 14618 (AMAZON-AES)
1 146.75.116.157 54113 (FASTLY)
1 13.32.121.82 16509 (AMAZON-02)
2 4 99.84.88.43 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
2 99.84.88.104 16509 (AMAZON-02)
5 104.244.42.69 13414 (TWITTER)
5 104.244.42.195 13414 (TWITTER)
1 1 2a05:d018:d29... 16509 (AMAZON-02)
1 2 67.220.226.233 16509 (AMAZON-02)
1 2620:1ec:21::14 8068 (MICROSOFT...)
2 2 52.210.176.42 16509 (AMAZON-02)
1 37.252.171.53 29990 (ASN-APPNEX)
1 216.52.2.6 32475 (SINGLEHOP...)
1 108.138.36.33 16509 (AMAZON-02)
1 145.40.97.66 54825 (PACKET)
1 1 52.3.98.252 14618 (AMAZON-AES)
1 2 172.64.146.152 13335 (CLOUDFLAR...)
1 23.48.23.23 20940 (AKAMAI-ASN1)
1 3.72.120.49 16509 (AMAZON-02)
1 34.149.50.64 15169 (GOOGLE)
1 192.132.33.68 18568 (BIDTELLECT)
2 2 37.157.6.254 198622 (ADFORM)
2 2 46.228.164.11 56396 (AMOBEE)
1 37.252.172.123 29990 (ASN-APPNEX)
6 7 46.228.174.117 56396 (AMOBEE)
1 35.244.174.68 15169 (GOOGLE)
1 54.216.109.54 16509 (AMAZON-02)
1 18.184.49.101 16509 (AMAZON-02)
1 67.202.105.24 32748 (STEADFAST)
1 34.107.140.113 396982 (GOOGLE-CL...)
1 38.91.45.7 398989 (DEEPINTENT)
1 64.202.112.95 23352 (SERVERCEN...)
1 1 35.204.158.49 396982 (GOOGLE-CL...)
1 34.96.105.8 396982 (GOOGLE-CL...)
2 2 2a02:fa8:8806... 41041 (VCLK-EU-SE)
1 18.195.70.244 16509 (AMAZON-02)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 34.107.148.139 396982 (GOOGLE-CL...)
1 96.46.186.182 7979 (SERVERS-COM)
1 1 85.114.159.118 24961 (MYLOC-AS ...)
1 52.209.84.7 16509 (AMAZON-02)
1 1 154.59.122.79 174 (COGENT-174)
1 34.228.147.1 14618 (AMAZON-AES)
1 1 38.68.201.140 174 (COGENT-174)
1 159.89.246.130 14061 (DIGITALOC...)
2 2620:1ec:bdf::44 8075 (MICROSOFT...)
1 2a02:fa8:8806... 41041 (VCLK-EU-SE)
3 3 35.157.195.10 16509 (AMAZON-02)
2 2 35.210.53.219 15169 (GOOGLE)
1 1 211.120.53.201 4694 (IDCF IDC ...)
1 54.219.114.202 16509 (AMAZON-02)
1 141.95.33.120 16276 (OVH)
1 1 143.244.208.184 14061 (DIGITALOC...)
1 2 81.17.55.172 60781 (LEASEWEB-...)
1 1 34.160.19.107 396982 (GOOGLE-CL...)
1 3.81.188.147 14618 (AMAZON-AES)
1 1 45.137.176.88 ()
2 2 3.217.218.110 14618 (AMAZON-AES)
1 99.84.88.13 16509 (AMAZON-02)
1 1 34.95.81.168 396982 (GOOGLE-CL...)
1 1 34.199.87.86 14618 (AMAZON-AES)
1 1 18.173.154.95 16509 (AMAZON-02)
1 54.82.17.205 14618 (AMAZON-AES)
2 4 35.163.158.243 16509 (AMAZON-02)
1 2 68.219.88.97 8075 (MICROSOFT...)
1 52.57.12.239 16509 (AMAZON-02)
1 69.192.160.219 16625 (AKAMAI-AS)
1 52.152.143.207 8075 (MICROSOFT...)
562 125
45    2606:4700::6811:9d16 (United States)

ASN13335 (CLOUDFLARENET, US)
www.theepochtimes.com
5    108.138.26.75 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-26-75.fra56.r.cloudfront.net
rumcdn.geoedge.be
1    2a04:4e42:800::282 (United States)

ASN54113 (FASTLY, US)
polyfill.io
2    2606:4700::6810:7caf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
10    2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net
6    2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
29    34.102.198.207 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 207.198.102.34.bc.googleusercontent.com
subs.theepochtimes.com
12    2606:4700:e6::ac40:cb07 (United States)

ASN13335 (CLOUDFLARENET, US)
services.epoch.cloud
mixproxy.epoch.cloud
cdn.epoch.cloud
subsapi.epoch.cloud
7    66.6.101.151 (Waverly, United States)

ASN11320 (LIGHTEDGE-AS-02, US)
entertainment.service.amuniversal.com
3    34.110.129.224 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 224.129.110.34.bc.googleusercontent.com
pwe.epochbase.com
5    52.30.181.208 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-181-208.eu-west-1.compute.amazonaws.com
hb.minutemedia-prebid.com
12    51.89.9.252 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip252.ip-51-89-9.eu
onetag-sys.com
6    52.210.49.96 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-49-96.eu-west-1.compute.amazonaws.com
hb-api.omnitagjs.com
visitor.omnitagjs.com
5    18.173.154.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-40.muc50.r.cloudfront.net
hb.undertone.com
5    107.22.251.49 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-22-251-49.compute-1.amazonaws.com
exchange.postrelease.com
23    34.120.33.89 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 89.33.120.34.bc.googleusercontent.com
comment.youmaker.com
3    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.analytics.google.com
region1.google-analytics.com
1    2a00:1450:400c:c1f::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
4    2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.ch
5    2001:4860:4802:38::178 (United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
6    2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
www.googletagservices.com
4    4.7.168.74 (White Haven, United States)

ASN3356 (LEVEL3, US)
ea.epochbase.com
4    2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    2a04:4e42::645 (United States)

ASN54113 (FASTLY, US)
mp.theepochtimes.com
1    2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
352c44ae8e3132a9bf53d7913c134ad8.safeframe.googlesyndication.com
1    23.45.238.53 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-45-238-53.deploy.static.akamaitechnologies.com
s7.addthis.com
51    18.173.187.86 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-187-86.muc50.r.cloudfront.net
securegames.iwin.com
1    2606:4700:e2::ac40:8d0d (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
5    2.19.198.122 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-19-198-122.deploy.static.akamaitechnologies.com
img.theepochtimes.com
2    151.101.66.133 (United States)

ASN54113 (FASTLY, US)
sdk.iad-05.braze.com
5    2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
4    99.84.93.134 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-93-134.muc50.r.cloudfront.net
gw.geoedge.be
1    44.219.140.141 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-219-140-141.compute-1.amazonaws.com
m.iwin.com
1    2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
6    2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
1    142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net
www.googleadservices.com
1    52.92.178.24 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2.amazonaws.com
s3-us-west-2.amazonaws.com
4    2400:52e0:1e00::1080:1 (Germany)

ASN200325 (BUNNYCDN, SI)
clientcdn.pushengage.com
tentacles.smartocto.com
1    2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    23.45.238.237 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-45-238-237.deploy.static.akamaitechnologies.com
d7d3cf2e81d293050033-3dfc0615b0fd7b49143049256703bfce.ssl.cf1.rackcdn.com
2    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    54.228.144.102 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-228-144-102.eu-west-1.compute.amazonaws.com
ingestion.contentinsights.com
2    2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
3    66.6.101.188 (Waverly, United States)

ASN11320 (LIGHTEDGE-AS-02, US)
picayune.uclick.com
1    34.249.188.76 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-188-76.eu-west-1.compute.amazonaws.com
api.smartocto.com
5    18.173.154.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-79.muc50.r.cloudfront.net
cdn.undertone.com
1    18.66.192.26 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-192-26.muc50.r.cloudfront.net
sdk.minutemedia-prebid.com
1    108.138.36.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-36-128.muc50.r.cloudfront.net
b-code.liadm.com
2    52.30.187.221 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-187-221.eu-west-1.compute.amazonaws.com
ingestion.smartocto.com
1    2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
9    2a00:1450:4001:808::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
accounts.google.com
40    104.18.36.155 (None, )

ASN13335 (CLOUDFLARENET, US)
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
r.casalemedia.com
5    23.56.202.187 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-56-202-187.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
10    23.35.229.251 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-229-251.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
10    35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
us-u.openx.net
38    99.84.88.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-88-111.muc50.r.cloudfront.net
usr.undertone.com
rules.quantcount.com
27    3.71.149.231 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-71-149-231.eu-central-1.compute.amazonaws.com
pixel.advertising.com
ups.analytics.yahoo.com
13    35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
insight.adsrvr.org
69    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
15    198.47.127.18 (United States)

ASN62713 (AS-PUBMATIC, US)
image8.pubmatic.com
19    142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net
cm.g.doubleclick.net
5    185.64.191.210 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
5    198.47.127.20 (United States)

ASN3257 (GTT-BACKBONE GTT, US)
image4.pubmatic.com
11    98.98.134.243 (United States)

ASN21859 (ZEN-ECN, US)
pixel-sync.sitescout.com
10    54.170.64.73 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-170-64-73.eu-west-1.compute.amazonaws.com
sync.crwdcntrl.net
12    34.111.113.62 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com
pixel.tapad.com
2    54.85.57.117 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-57-117.compute-1.amazonaws.com
events.iwin.com
5    18.200.44.133 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-200-44-133.eu-west-1.compute.amazonaws.com
cs.minutemedia-prebid.com
13    52.22.32.84 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-32-84.compute-1.amazonaws.com
i.liadm.com
5    178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
dis.criteo.com
5    2600:1f18:ed:550a:3539:381b:7999:2df1 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
i6.liadm.com
9    52.46.155.104 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
2    72.251.241.196 (Amsterdam, Netherlands)

ASN32475 (SINGLEHOP-LLC, US)
cm.adgrx.com
2    193.0.160.130 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
3    50.31.142.223 (Hickory Hills, United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: chi.outbrain.com
b1sync.zemanta.com
2    34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com
s.company-target.com
4    185.86.139.104 (France)

ASN201081 (SMARTADSERVER, FR)
ssbsync.smartadserver.com
rtb-csync.smartadserver.com
4    2620:116:800d:21:e365:4988:e8a7:3270 (United States)

ASN16509 (AMAZON-02, US)
cms.quantserve.com
secure.quantserve.com
pixel.quantserve.com
3    151.101.66.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
5    3.124.253.58 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-253-58.eu-central-1.compute.amazonaws.com
pm.w55c.net
4    54.198.207.123 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-198-207-123.compute-1.amazonaws.com
sync.srv.stackadapt.com
1    2606:4700:20::681a:ad1 (United States)

ASN13335 (CLOUDFLARENET, US)
ad4m.at
1    2a05:d018:cc3:fe04:3684:ac58:ec44:5836 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
d.adroll.com
2    35.214.210.123 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 123.210.214.35.bc.googleusercontent.com
csync.loopme.me
2    134.122.57.34 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
match.adsby.bidtheatre.com
1    2600:1f18:730:b140:4f29:101d:62a7:ca97 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
rp.liadm.com
1    35.168.179.116 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-179-116.compute-1.amazonaws.com
rp4.liadm.com
2    185.184.8.90 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net
creativecdn.com
2    13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com
eb2.3lift.com
1    63.251.14.14 (United States)

ASN14744 (INTERNAP-BLOCK-4, US)
PTR: 14.14.251.63.unassigned.ord.singlehop.net
ap.lijit.com
2    208.93.169.131 (United States)

ASN46244 (WEBMD-IDC1-AS, US)
bh.contextweb.com
13    69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
1    2606:4700:20::681a:27a (United States)

ASN13335 (CLOUDFLARENET, US)
a.remarketstats.com
2    2606:4700:20::681a:832 (United States)

ASN13335 (CLOUDFLARENET, US)
a.clickcertain.com
4    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
c.bing.com
4    52.202.83.199 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-83-199.compute-1.amazonaws.com
tags.wdsvc.net
1    146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
1    13.32.121.82 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-82.fra60.r.cloudfront.net
js.alocdn.com
4    99.84.88.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-88-43.muc50.r.cloudfront.net
sb.scorecardresearch.com
4    2a00:1450:4001:831::2011 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
csp.withgoogle.com
2    99.84.88.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-88-104.muc50.r.cloudfront.net
cti.w55c.net
5    104.244.42.69 (United States)

ASN13414 (TWITTER, US)
t.co
5    104.244.42.195 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
1    2a05:d018:d29:3605:110e:d660:4b1d:6eeb (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
pr-bh.ybp.yahoo.com
2    67.220.226.233 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
1    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
2    52.210.176.42 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-176-42.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
1    37.252.171.53 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com
1    216.52.2.6 (United States)

ASN32475 (SINGLEHOP-LLC, US)
ce.lijit.com
1    108.138.36.33 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-36-33.muc50.r.cloudfront.net
live.primis.tech
1    145.40.97.66 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
prebid.a-mo.net
1    52.3.98.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-98-252.compute-1.amazonaws.com
sync.ipredictive.com
2    172.64.146.152 (United States)

ASN13335 (CLOUDFLARENET, US)
capi.connatix.com
1    23.48.23.23 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-48-23-23.deploy.static.akamaitechnologies.com
hb.yahoo.net
1    3.72.120.49 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-72-120-49.eu-central-1.compute.amazonaws.com
match.sharethrough.com
1    34.149.50.64 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 64.50.149.34.bc.googleusercontent.com
s.seedtag.com
1    192.132.33.68 (United States)

ASN18568 (BIDTELLECT, US)
PTR: NET-33-132-192.68.bidtellect.com
bttrack.com
2    37.157.6.254 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
2    46.228.164.11 (United Kingdom)

ASN56396 (AMOBEE, GB)
ad.turn.com
1    37.252.172.123 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
secure.adnxs.com
7    46.228.174.117 (United Kingdom)

ASN56396 (AMOBEE, GB)
sync.1rx.io
sync.targeting.unrulymedia.com
1    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
1    54.216.109.54 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-216-109-54.eu-west-1.compute.amazonaws.com
cs.yellowblue.io
1    18.184.49.101 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-49-101.eu-central-1.compute.amazonaws.com
exchange.mediavine.com
1    67.202.105.24 (United States)

ASN32748 (STEADFAST, US)
PTR: ip24.67-202-105.static.steadfastdns.net
ssc-cms.33across.com
1    34.107.140.113 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 113.140.107.34.bc.googleusercontent.com
s2s.t13.io
1    38.91.45.7 (Ashburn, United States)

ASN398989 (DEEPINTENT, US)
match.deepintent.com
1    64.202.112.95 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com
sync.outbrain.com
1    35.204.158.49 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 49.158.204.35.bc.googleusercontent.com
um.simpli.fi
1    34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com
tr.blismedia.com
2    2a02:fa8:8806:20::2010 (Singapore)

ASN41041 (VCLK-EU-SE, US)
rubicon-match.dotomi.com
1    18.195.70.244 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-70-244.eu-central-1.compute.amazonaws.com
crb.kargo.com
2    2606:4700::6812:18ad (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
1    34.107.148.139 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 139.148.107.34.bc.googleusercontent.com
prebid-s2s.media.net
1    96.46.186.182 (United States)

ASN7979 (SERVERS-COM, US)
sync.aniview.com
1    85.114.159.118 (Loerrach, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com
dsp.adfarm1.adition.com
1    52.209.84.7 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-84-7.eu-west-1.compute.amazonaws.com
ads.yieldmo.com
1    154.59.122.79 (Schiphol, Netherlands)

ASN174 (COGENT-174, US)
ums.acuityplatform.com
1    34.228.147.1 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-228-147-1.compute-1.amazonaws.com
sync.ex.co
1    38.68.201.140 (Ashburn, United States)

ASN174 (COGENT-174, US)
rbp.mxptint.net
1    159.89.246.130 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
e.serverbid.com
2    2620:1ec:bdf::44 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.clarity.ms
1    2a02:fa8:8806:21::1780 (Singapore)

ASN41041 (VCLK-EU-SE, US)
match.sync.ad.cpe.dotomi.com
3    35.157.195.10 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-195-10.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    35.210.53.219 (Brussels, Belgium)

ASN15169 (GOOGLE, US)
PTR: 219.53.210.35.bc.googleusercontent.com
pool.admedo.com
1    211.120.53.201 (Japan)

ASN4694 (IDCF IDC Frontier Inc., JP)
tg.socdm.com
1    54.219.114.202 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-219-114-202.us-west-1.compute.amazonaws.com
usync.vrtcal.com
1    141.95.33.120 (Germany)

ASN16276 (OVH, FR)
PTR: ns3203256.ip-141-95-33.eu
id5-sync.com
1    143.244.208.184 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
sid.storygize.net
2    81.17.55.172 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
sync.smartadserver.com
1    34.160.19.107 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 107.19.160.34.bc.googleusercontent.com
dmp.brand-display.com
1    3.81.188.147 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-81-188-147.compute-1.amazonaws.com
rtb.adentifi.com
1    45.137.176.88 (None, )

ASN- ()
sync.adotmob.com
2    3.217.218.110 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-217-218-110.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
1    99.84.88.13 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-88-13.muc50.r.cloudfront.net
sync.intentiq.com
1    34.95.81.168 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 168.81.95.34.bc.googleusercontent.com
rubiconcm.digitaleast.mobi
1    34.199.87.86 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-199-87-86.compute-1.amazonaws.com
um4.eqads.com
1    18.173.154.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-95.muc50.r.cloudfront.net
cm.smadex.com
1    54.82.17.205 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-82-17-205.compute-1.amazonaws.com
idx.liadm.com
4    35.163.158.243 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-163-158-243.us-west-2.compute.amazonaws.com
p.alocdn.com
2    68.219.88.97 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.clarity.ms
1    52.57.12.239 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-12-239.eu-central-1.compute.amazonaws.com
tags.w55c.net
1    69.192.160.219 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-219.deploy.static.akamaitechnologies.com
tags.bluekai.com
1    52.152.143.207 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
o.clarity.ms
Apex Domain
Subdomains		 Transfer
97 rubiconproject.com
secure-assets.rubiconproject.com — Cisco Umbrella Rank: 969
eus.rubiconproject.com — Cisco Umbrella Rank: 602
pixel.rubiconproject.com — Cisco Umbrella Rank: 376
token.rubiconproject.com — Cisco Umbrella Rank: 458
138 KB
82 theepochtimes.com
www.theepochtimes.com — Cisco Umbrella Rank: 45532
subs.theepochtimes.com — Cisco Umbrella Rank: 75799
mp.theepochtimes.com
img.theepochtimes.com — Cisco Umbrella Rank: 42115
2 MB
54 iwin.com
securegames.iwin.com — Cisco Umbrella Rank: 448939
m.iwin.com — Cisco Umbrella Rank: 551746
events.iwin.com — Cisco Umbrella Rank: 398011
622 KB
47 undertone.com
hb.undertone.com — Cisco Umbrella Rank: 3825
cdn.undertone.com — Cisco Umbrella Rank: 3330
usr.undertone.com — Cisco Umbrella Rank: 1938
31 KB
40 casalemedia.com
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 486
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 625
r.casalemedia.com — Cisco Umbrella Rank: 1699
28 KB
33 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196
stats.g.doubleclick.net — Cisco Umbrella Rank: 78
googleads.g.doubleclick.net — Cisco Umbrella Rank: 33
cm.g.doubleclick.net — Cisco Umbrella Rank: 245
331 KB
25 pubmatic.com
image8.pubmatic.com — Cisco Umbrella Rank: 662
image2.pubmatic.com — Cisco Umbrella Rank: 924
image4.pubmatic.com — Cisco Umbrella Rank: 1184
6 KB
23 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 327
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 492
4 KB
23 youmaker.com
comment.youmaker.com — Cisco Umbrella Rank: 69537
355 KB
22 liadm.com
b-code.liadm.com — Cisco Umbrella Rank: 3063
i.liadm.com — Cisco Umbrella Rank: 539
i6.liadm.com — Cisco Umbrella Rank: 2731
rp.liadm.com — Cisco Umbrella Rank: 1574
rp4.liadm.com — Cisco Umbrella Rank: 6581
idx.liadm.com — Cisco Umbrella Rank: 2376
26 KB
15 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3040
www.google.com — Cisco Umbrella Rank: 2
accounts.google.com — Cisco Umbrella Rank: 24
325 KB
13 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 353
insight.adsrvr.org — Cisco Umbrella Rank: 584
2 KB
12 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 487
4 KB
12 googlesyndication.com
352c44ae8e3132a9bf53d7913c134ad8.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 149
pagead2.googlesyndication.com — Cisco Umbrella Rank: 97
366 KB
12 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 746
7 KB
12 epoch.cloud
services.epoch.cloud — Cisco Umbrella Rank: 81186
mixproxy.epoch.cloud — Cisco Umbrella Rank: 74701
cdn.epoch.cloud — Cisco Umbrella Rank: 87631
subsapi.epoch.cloud — Cisco Umbrella Rank: 83402
200 KB
11 amazon-adsystem.com
s.amazon-adsystem.com — Cisco Umbrella Rank: 310
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 890
8 KB
11 sitescout.com
pixel-sync.sitescout.com — Cisco Umbrella Rank: 726
7 KB
11 minutemedia-prebid.com
hb.minutemedia-prebid.com — Cisco Umbrella Rank: 3706
sdk.minutemedia-prebid.com — Cisco Umbrella Rank: 6619
cs.minutemedia-prebid.com — Cisco Umbrella Rank: 1901
12 KB
10 crwdcntrl.net
sync.crwdcntrl.net — Cisco Umbrella Rank: 865
5 KB
10 openx.net
us-u.openx.net — Cisco Umbrella Rank: 522
2 KB
9 geoedge.be
rumcdn.geoedge.be — Cisco Umbrella Rank: 2295
gw.geoedge.be — Cisco Umbrella Rank: 2817
248 KB
8 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 912
cti.w55c.net — Cisco Umbrella Rank: 2945
tags.w55c.net — Cisco Umbrella Rank: 4016
19 KB
7 epochbase.com
pwe.epochbase.com — Cisco Umbrella Rank: 70606
ea.epochbase.com — Cisco Umbrella Rank: 72240
46 KB
7 amuniversal.com
entertainment.service.amuniversal.com — Cisco Umbrella Rank: 378231
147 KB
6 smartadserver.com
ssbsync.smartadserver.com — Cisco Umbrella Rank: 774
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 733
sync.smartadserver.com — Cisco Umbrella Rank: 1330
2 KB
6 smartocto.com
tentacles.smartocto.com — Cisco Umbrella Rank: 24032
api.smartocto.com — Cisco Umbrella Rank: 22872
ingestion.smartocto.com — Cisco Umbrella Rank: 20291
20 KB
6 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
region1.google-analytics.com — Cisco Umbrella Rank: 2462
64 KB
6 omnitagjs.com
hb-api.omnitagjs.com — Cisco Umbrella Rank: 3481
visitor.omnitagjs.com — Cisco Umbrella Rank: 799
4 KB
6 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 35
473 KB
5 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 827
c.clarity.ms — Cisco Umbrella Rank: 1405
o.clarity.ms — Cisco Umbrella Rank: 7480
23 KB
5 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 567
2 KB
5 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 747
3 KB
5 t.co
t.co — Cisco Umbrella Rank: 607
1 KB
5 alocdn.com
js.alocdn.com — Cisco Umbrella Rank: 60885
p.alocdn.com — Cisco Umbrella Rank: 7036
4 KB
5 criteo.com
dis.criteo.com — Cisco Umbrella Rank: 597
2 KB
5 advertising.com
pixel.advertising.com — Cisco Umbrella Rank: 1733
1 KB
5 postrelease.com
exchange.postrelease.com — Cisco Umbrella Rank: 4810
2 KB
4 withgoogle.com
csp.withgoogle.com — Cisco Umbrella Rank: 504
4 scorecardresearch.com
sb.scorecardresearch.com — Cisco Umbrella Rank: 172
1 KB
4 wdsvc.net
tags.wdsvc.net — Cisco Umbrella Rank: 40509
30 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 366
c.bing.com — Cisco Umbrella Rank: 236
16 KB
4 stackadapt.com
sync.srv.stackadapt.com — Cisco Umbrella Rank: 689
5 KB
4 quantserve.com
cms.quantserve.com — Cisco Umbrella Rank: 764
secure.quantserve.com — Cisco Umbrella Rank: 1245
pixel.quantserve.com — Cisco Umbrella Rank: 964
10 KB
4 google.ch
www.google.ch — Cisco Umbrella Rank: 30247
690 B
3 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 351
1 KB
3 dotomi.com
rubicon-match.dotomi.com — Cisco Umbrella Rank: 2310
match.sync.ad.cpe.dotomi.com — Cisco Umbrella Rank: 1646
994 B
3 everesttech.net
sync-tm.everesttech.net — Cisco Umbrella Rank: 709
754 B
3 zemanta.com
b1sync.zemanta.com — Cisco Umbrella Rank: 580
934 B
3 uclick.com
picayune.uclick.com
254 KB
3 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 212
157 KB
2 cognitivlabs.com
beacon.lynx.cognitivlabs.com — Cisco Umbrella Rank: 1484
1 KB
2 admedo.com
pool.admedo.com — Cisco Umbrella Rank: 5328
749 B
2 tribalfusion.com
a.tribalfusion.com — Cisco Umbrella Rank: 860
s.tribalfusion.com — Cisco Umbrella Rank: 2311
994 B
2 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1268
872 B
2 turn.com
ad.turn.com — Cisco Umbrella Rank: 851
885 B
2 adform.net
c1.adform.net — Cisco Umbrella Rank: 599
1 KB
2 connatix.com
capi.connatix.com — Cisco Umbrella Rank: 1113
522 B
2 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 246
secure.adnxs.com — Cisco Umbrella Rank: 495
1 KB
2 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 573
1 KB
2 clickcertain.com
a.clickcertain.com — Cisco Umbrella Rank: 7633
3 KB
2 contextweb.com
bh.contextweb.com — Cisco Umbrella Rank: 547
1 KB
2 lijit.com
ap.lijit.com — Cisco Umbrella Rank: 683
ce.lijit.com — Cisco Umbrella Rank: 882
588 B
2 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 417
736 B
2 creativecdn.com
creativecdn.com — Cisco Umbrella Rank: 592
1 KB
2 bidtheatre.com
match.adsby.bidtheatre.com — Cisco Umbrella Rank: 2242
1 KB
2 loopme.me
csync.loopme.me — Cisco Umbrella Rank: 940
418 B
2 company-target.com
s.company-target.com — Cisco Umbrella Rank: 1489
736 B
2 rfihub.com
p.rfihub.com — Cisco Umbrella Rank: 868
1 KB
2 adgrx.com
cm.adgrx.com — Cisco Umbrella Rank: 1392
565 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174
89 KB
2 contentinsights.com
ingestion.contentinsights.com — Cisco Umbrella Rank: 27776
176 B
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1137
31 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
ajax.googleapis.com — Cisco Umbrella Rank: 364
35 KB
2 braze.com
sdk.iad-05.braze.com — Cisco Umbrella Rank: 3876
407 B
2 unpkg.com
unpkg.com — Cisco Umbrella Rank: 903
14 KB
1 bluekai.com
tags.bluekai.com — Cisco Umbrella Rank: 685
426 B
1 smadex.com
cm.smadex.com — Cisco Umbrella Rank: 2636
583 B
1 eqads.com
um4.eqads.com — Cisco Umbrella Rank: 2479
260 B
1 digitaleast.mobi
rubiconcm.digitaleast.mobi — Cisco Umbrella Rank: 3233
267 B
1 intentiq.com
sync.intentiq.com — Cisco Umbrella Rank: 886
1 adotmob.com
sync.adotmob.com
687 B
1 adentifi.com
rtb.adentifi.com — Cisco Umbrella Rank: 1218
35 B
1 brand-display.com
dmp.brand-display.com — Cisco Umbrella Rank: 1608
348 B
1 storygize.net
sid.storygize.net — Cisco Umbrella Rank: 1564
310 B
1 id5-sync.com
id5-sync.com — Cisco Umbrella Rank: 440
921 B
1 vrtcal.com
usync.vrtcal.com — Cisco Umbrella Rank: 2864
257 B
1 socdm.com
tg.socdm.com — Cisco Umbrella Rank: 1208
875 B
1 serverbid.com
e.serverbid.com — Cisco Umbrella Rank: 2175
405 B
1 mxptint.net
rbp.mxptint.net — Cisco Umbrella Rank: 3146
694 B
1 ex.co
sync.ex.co — Cisco Umbrella Rank: 12875
376 B
1 acuityplatform.com
ums.acuityplatform.com — Cisco Umbrella Rank: 1309
657 B
1 yieldmo.com
ads.yieldmo.com — Cisco Umbrella Rank: 657
600 B
1 adition.com
dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1533
471 B
1 aniview.com
sync.aniview.com — Cisco Umbrella Rank: 1534
251 B
1 media.net
prebid-s2s.media.net — Cisco Umbrella Rank: 2807
509 B
1 kargo.com
crb.kargo.com — Cisco Umbrella Rank: 1180
375 B
1 blismedia.com
tr.blismedia.com — Cisco Umbrella Rank: 1824
173 B
1 simpli.fi
um.simpli.fi — Cisco Umbrella Rank: 795
632 B
1 outbrain.com
sync.outbrain.com — Cisco Umbrella Rank: 807
145 B
1 deepintent.com
match.deepintent.com — Cisco Umbrella Rank: 1055
44 B
1 t13.io
s2s.t13.io — Cisco Umbrella Rank: 1873
449 B
1 33across.com
ssc-cms.33across.com — Cisco Umbrella Rank: 923
73 B
1 mediavine.com
exchange.mediavine.com — Cisco Umbrella Rank: 1284
186 B
1 yellowblue.io
cs.yellowblue.io — Cisco Umbrella Rank: 1590
326 B
1 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 728
1 bttrack.com
bttrack.com — Cisco Umbrella Rank: 826
163 B
1 seedtag.com
s.seedtag.com — Cisco Umbrella Rank: 1735
284 B
1 sharethrough.com
match.sharethrough.com — Cisco Umbrella Rank: 559
35 B
1 yahoo.net
hb.yahoo.net — Cisco Umbrella Rank: 938
315 B
1 ipredictive.com
sync.ipredictive.com — Cisco Umbrella Rank: 909
493 B
1 a-mo.net
prebid.a-mo.net — Cisco Umbrella Rank: 751
188 B
1 primis.tech
live.primis.tech — Cisco Umbrella Rank: 1458
523 B
1 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 377
649 B
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 1212
457 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 713
15 KB
1 remarketstats.com
a.remarketstats.com — Cisco Umbrella Rank: 40202
553 B
1 adroll.com
d.adroll.com — Cisco Umbrella Rank: 1356
181 B
1 ad4m.at
ad4m.at — Cisco Umbrella Rank: 12394
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 110
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 762
105 KB
1 rackcdn.com
d7d3cf2e81d293050033-3dfc0615b0fd7b49143049256703bfce.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 41865
5 KB
1 pushengage.com
clientcdn.pushengage.com — Cisco Umbrella Rank: 22697
1 amazonaws.com
s3-us-west-2.amazonaws.com
60 KB
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 145
2 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223
1 KB
1 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1002
9 KB
1 addthis.com
s7.addthis.com — Cisco Umbrella Rank: 3240
360 B
1 polyfill.io
polyfill.io — Cisco Umbrella Rank: 1329
618 B
0 gammaplatform.com Failed
cm-supply-web.gammaplatform.com Failed
562 130
Domain Requested by
69 pixel.rubiconproject.com 37 redirects cdn.undertone.com
eus.rubiconproject.com
51 securegames.iwin.com 1 redirects entertainment.service.amuniversal.com
securegames.iwin.com
45 www.theepochtimes.com www.theepochtimes.com
rumcdn.geoedge.be
37 usr.undertone.com cdn.undertone.com
ssum-sec.casalemedia.com
29 subs.theepochtimes.com www.theepochtimes.com
subs.theepochtimes.com
rumcdn.geoedge.be
25 dsum-sec.casalemedia.com 5 redirects ssum-sec.casalemedia.com
23 comment.youmaker.com www.theepochtimes.com
comment.youmaker.com
22 ups.analytics.yahoo.com 22 redirects
19 cm.g.doubleclick.net 17 redirects cdn.undertone.com
15 image8.pubmatic.com 15 redirects
14 ssum-sec.casalemedia.com 5 redirects cdn.undertone.com
ssum-sec.casalemedia.com
13 token.rubiconproject.com 8 redirects eus.rubiconproject.com
13 i.liadm.com 13 redirects
12 pixel.tapad.com 11 redirects cdn.undertone.com
12 onetag-sys.com 1 redirects www.theepochtimes.com
sdk.minutemedia-prebid.com
11 pixel-sync.sitescout.com 11 redirects
10 sync.crwdcntrl.net 10 redirects
10 match.adsrvr.org cdn.undertone.com
ssum-sec.casalemedia.com
10 us-u.openx.net 10 redirects
10 eus.rubiconproject.com cdn.undertone.com
eus.rubiconproject.com
10 securepubads.g.doubleclick.net www.theepochtimes.com
rumcdn.geoedge.be
securepubads.g.doubleclick.net
www.googletagservices.com
9 s.amazon-adsystem.com 4 redirects ssum-sec.casalemedia.com
cdn.undertone.com
9 accounts.google.com securegames.iwin.com
accounts.google.com
rumcdn.geoedge.be
7 entertainment.service.amuniversal.com www.theepochtimes.com
entertainment.service.amuniversal.com
6 pagead2.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
rumcdn.geoedge.be
6 services.epoch.cloud www.theepochtimes.com
rumcdn.geoedge.be
subs.theepochtimes.com
6 www.googletagmanager.com www.theepochtimes.com
www.googletagmanager.com
securegames.iwin.com
5 sync.1rx.io 5 redirects
5 analytics.twitter.com
5 t.co
5 pm.w55c.net 5 redirects
5 i6.liadm.com ssum-sec.casalemedia.com
cdn.undertone.com
5 dis.criteo.com 5 redirects
5 cs.minutemedia-prebid.com sdk.minutemedia-prebid.com
cdn.undertone.com
5 image4.pubmatic.com 5 redirects
5 image2.pubmatic.com 5 redirects
5 pixel.advertising.com 5 redirects
5 secure-assets.rubiconproject.com 5 redirects
5 cdn.undertone.com www.theepochtimes.com
5 tpc.googlesyndication.com rumcdn.geoedge.be
5 img.theepochtimes.com comment.youmaker.com
5 www.google-analytics.com subs.theepochtimes.com
entertainment.service.amuniversal.com
www.google-analytics.com
securegames.iwin.com
5 exchange.postrelease.com www.theepochtimes.com
5 hb.undertone.com www.theepochtimes.com
5 hb-api.omnitagjs.com www.theepochtimes.com
5 hb.minutemedia-prebid.com www.theepochtimes.com
5 rumcdn.geoedge.be www.theepochtimes.com
rumcdn.geoedge.be
4 p.alocdn.com 2 redirects
4 csp.withgoogle.com www.theepochtimes.com
4 sb.scorecardresearch.com 2 redirects
4 tags.wdsvc.net 1 redirects tags.wdsvc.net
4 sync.srv.stackadapt.com 4 redirects
4 gw.geoedge.be rumcdn.geoedge.be
4 www.google.com 1 redirects www.theepochtimes.com
rumcdn.geoedge.be
4 ea.epochbase.com subs.theepochtimes.com
4 www.google.ch www.theepochtimes.com
3 insight.adsrvr.org
3 x.bidswitch.net 3 redirects
3 bat.bing.com www.theepochtimes.com
rumcdn.geoedge.be
3 sync-tm.everesttech.net 3 redirects
3 ssbsync.smartadserver.com 3 redirects
3 b1sync.zemanta.com 3 redirects
3 picayune.uclick.com securegames.iwin.com
3 tentacles.smartocto.com rumcdn.geoedge.be
3 mixproxy.epoch.cloud services.epoch.cloud
mixproxy.epoch.cloud
3 www.googletagservices.com entertainment.service.amuniversal.com
rumcdn.geoedge.be
3 mp.theepochtimes.com www.theepochtimes.com
3 googleads.g.doubleclick.net 1 redirects rumcdn.geoedge.be
3 pwe.epochbase.com www.theepochtimes.com
subs.theepochtimes.com
2 c.clarity.ms 1 redirects
2 beacon.lynx.cognitivlabs.com 2 redirects
2 sync.smartadserver.com 1 redirects eus.rubiconproject.com
2 pool.admedo.com 2 redirects
2 www.clarity.ms bat.bing.com
www.clarity.ms
2 rubicon-match.dotomi.com 2 redirects
2 sync.targeting.unrulymedia.com 1 redirects cdn.undertone.com
2 ad.turn.com 2 redirects
2 c1.adform.net 2 redirects
2 capi.connatix.com 1 redirects cdn.undertone.com
2 match.prod.bidr.io 2 redirects
2 aax-eu.amazon-adsystem.com 1 redirects cdn.undertone.com
2 cti.w55c.net eus.rubiconproject.com
cti.w55c.net
2 a.clickcertain.com 1 redirects
2 bh.contextweb.com 2 redirects
2 eb2.3lift.com 2 redirects
2 creativecdn.com 2 redirects
2 match.adsby.bidtheatre.com 2 redirects
2 csync.loopme.me 1 redirects cdn.undertone.com
2 cms.quantserve.com 2 redirects
2 s.company-target.com 2 redirects
2 p.rfihub.com 2 redirects
2 cm.adgrx.com ssum-sec.casalemedia.com
cdn.undertone.com
2 events.iwin.com securegames.iwin.com
2 ingestion.smartocto.com tentacles.smartocto.com
2 connect.facebook.net securegames.iwin.com
connect.facebook.net
2 ingestion.contentinsights.com
2 maxcdn.bootstrapcdn.com securegames.iwin.com
2 subsapi.epoch.cloud www.theepochtimes.com
2 sdk.iad-05.braze.com www.theepochtimes.com
2 region1.analytics.google.com www.googletagmanager.com
2 unpkg.com 1 redirects www.theepochtimes.com
1 o.clarity.ms www.clarity.ms
1 tags.bluekai.com cti.w55c.net
1 tags.w55c.net cti.w55c.net
1 c.bing.com 1 redirects
1 pixel.quantserve.com
1 idx.liadm.com b-code.liadm.com
1 cm.smadex.com 1 redirects
1 um4.eqads.com 1 redirects
1 rubiconcm.digitaleast.mobi 1 redirects
1 sync.intentiq.com eus.rubiconproject.com
1 sync.adotmob.com 1 redirects
1 rtb.adentifi.com eus.rubiconproject.com
1 dmp.brand-display.com 1 redirects
1 sid.storygize.net 1 redirects
1 id5-sync.com eus.rubiconproject.com
1 usync.vrtcal.com eus.rubiconproject.com
1 tg.socdm.com 1 redirects
1 match.sync.ad.cpe.dotomi.com cdn.undertone.com
1 e.serverbid.com cdn.undertone.com
1 rbp.mxptint.net 1 redirects
1 sync.ex.co cdn.undertone.com
1 ums.acuityplatform.com 1 redirects
1 rtb-csync.smartadserver.com cdn.undertone.com
1 ads.yieldmo.com cdn.undertone.com
1 dsp.adfarm1.adition.com 1 redirects
1 sync.aniview.com cdn.undertone.com
1 prebid-s2s.media.net cdn.undertone.com
1 s.tribalfusion.com cdn.undertone.com
1 a.tribalfusion.com 1 redirects
1 crb.kargo.com cdn.undertone.com
1 tr.blismedia.com cdn.undertone.com
1 um.simpli.fi 1 redirects
1 sync.outbrain.com cdn.undertone.com
1 match.deepintent.com cdn.undertone.com
1 s2s.t13.io cdn.undertone.com
1 ssc-cms.33across.com cdn.undertone.com
1 exchange.mediavine.com cdn.undertone.com
1 cs.yellowblue.io cdn.undertone.com
1 visitor.omnitagjs.com cdn.undertone.com
1 id.rlcdn.com cdn.undertone.com
1 secure.adnxs.com cdn.undertone.com
1 bttrack.com cdn.undertone.com
1 s.seedtag.com cdn.undertone.com
1 match.sharethrough.com cdn.undertone.com
1 hb.yahoo.net cdn.undertone.com
1 sync.ipredictive.com 1 redirects
1 prebid.a-mo.net cdn.undertone.com
1 live.primis.tech cdn.undertone.com
1 ce.lijit.com cdn.undertone.com
1 ib.adnxs.com cdn.undertone.com
1 px.ads.linkedin.com cdn.undertone.com
1 pr-bh.ybp.yahoo.com 1 redirects
1 rules.quantcount.com secure.quantserve.com
1 js.alocdn.com www.googletagmanager.com
1 static.ads-twitter.com www.theepochtimes.com
1 a.remarketstats.com 1 redirects
1 secure.quantserve.com www.theepochtimes.com
1 ap.lijit.com sdk.minutemedia-prebid.com
1 rp4.liadm.com
1 rp.liadm.com 1 redirects
1 d.adroll.com ssum-sec.casalemedia.com
1 r.casalemedia.com ssum-sec.casalemedia.com
1 ad4m.at ssum-sec.casalemedia.com
1 www.facebook.com connect.facebook.net
1 b-code.liadm.com rumcdn.geoedge.be
1 sdk.minutemedia-prebid.com www.theepochtimes.com
1 api.smartocto.com tentacles.smartocto.com
1 code.jquery.com securegames.iwin.com
1 ajax.googleapis.com securegames.iwin.com
1 d7d3cf2e81d293050033-3dfc0615b0fd7b49143049256703bfce.ssl.cf1.rackcdn.com services.epoch.cloud
1 fonts.googleapis.com rumcdn.geoedge.be
1 region1.google-analytics.com www.googletagmanager.com
1 clientcdn.pushengage.com rumcdn.geoedge.be
1 s3-us-west-2.amazonaws.com www.theepochtimes.com
1 www.googleadservices.com rumcdn.geoedge.be
1 cdnjs.cloudflare.com subs.theepochtimes.com
1 m.iwin.com www.theepochtimes.com
1 cdn.epoch.cloud www.theepochtimes.com
1 use.fontawesome.com comment.youmaker.com
1 s7.addthis.com entertainment.service.amuniversal.com
1 352c44ae8e3132a9bf53d7913c134ad8.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 stats.g.doubleclick.net www.googletagmanager.com
1 polyfill.io www.theepochtimes.com
0 cm-supply-web.gammaplatform.com Failed ssum-sec.casalemedia.com
562 185

This site contains links to these domains. Also see Links.

Domain
help.theepochtimes.com
www.facebook.com
twitter.com
www.geoedge.com
Subject Issuer Validity Valid
*.theepochtimes.com
Sectigo RSA Domain Validation Secure Server CA		 2023-06-18 -
2024-07-17		 a year crt.sh
gw.geoedge.be
Amazon RSA 2048 M01		 2023-08-12 -
2024-09-09		 a year crt.sh
polyfill.io
Certainly Intermediate R1		 2023-11-12 -
2023-12-12		 a month crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
epoch.cloud
GTS CA 1P5		 2023-10-30 -
2024-01-28		 3 months crt.sh
entertainment.service.amuniversal.com
Go Daddy Secure Certificate Authority - G2		 2022-12-10 -
2024-01-11		 a year crt.sh
*.epochbase.com
Sectigo RSA Domain Validation Secure Server CA		 2022-12-17 -
2024-01-17		 a year crt.sh
*.minutemedia-prebid.com
Amazon ECDSA 256 M01		 2023-04-18 -
2024-05-16		 a year crt.sh
*.onetag-sys.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-12-28 -
2024-01-28		 a year crt.sh
omnitagjs.com
Sectigo RSA Domain Validation Secure Server CA		 2023-06-23 -
2024-07-22		 a year crt.sh
*.undertone.com
Amazon RSA 2048 M02		 2023-08-03 -
2024-08-30		 a year crt.sh
*.postrelease.com
Amazon RSA 2048 M02		 2023-10-27 -
2024-11-23		 a year crt.sh
*.youmaker.com
Sectigo RSA Domain Validation Secure Server CA		 2023-06-18 -
2024-07-17		 a year crt.sh
*.google.ch
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
mp.theepochtimes.com
GlobalSign Atlas R3 DV TLS CA 2023 Q4		 2023-10-24 -
2024-11-24		 a year crt.sh
odc-addthis-prod-01.oracle.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-07 -
2024-02-07		 a year crt.sh
*.iwin.com
Amazon RSA 2048 M02		 2023-11-26 -
2024-12-24		 a year crt.sh
use.fontawesome.com
Cloudflare Inc ECC CA-3		 2023-10-12 -
2024-10-10		 a year crt.sh
*.iad-05.braze.com
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-07-27 -
2024-08-27		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
www.googleadservices.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.s3-us-west-2.amazonaws.com
Amazon RSA 2048 M01		 2023-10-10 -
2024-08-03		 10 months crt.sh
*.pushengage.com
AlphaSSL CA - SHA256 - G4		 2023-02-07 -
2024-03-10		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.ssl.cf1.rackcdn.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-03-27 -
2024-03-28		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
ingestion.smartocto.com
Amazon RSA 2048 M01		 2023-10-11 -
2024-11-08		 a year crt.sh
*.smartocto.com
R3		 2023-11-08 -
2024-02-06		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-09-07 -
2023-12-06		 3 months crt.sh
picayune.uclick.com
Go Daddy Secure Certificate Authority - G2		 2023-07-06 -
2024-08-06		 a year crt.sh
sdk.minutemedia-prebid.com
Amazon RSA 2048 M01		 2023-02-19 -
2024-03-20		 a year crt.sh
*.liadm.com
Amazon RSA 2048 M02		 2023-02-28 -
2024-01-30		 a year crt.sh
accounts.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
casalemedia.com
Cloudflare Inc ECC CA-3		 2023-05-21 -
2024-05-20		 a year crt.sh
*.rubiconproject.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-03-07 -
2024-04-03		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2023-04-12 -
2024-05-13		 a year crt.sh
public1.adgear.com
Sectigo RSA Domain Validation Secure Server CA		 2023-03-03 -
2024-03-31		 a year crt.sh
d.adroll.com
Amazon RSA 2048 M01		 2023-10-09 -
2024-11-07		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2023-05-06 -
2024-05-04		 a year crt.sh
quantserve.com
R3		 2023-10-28 -
2024-01-26		 3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 01		 2023-10-24 -
2024-04-21		 6 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-07-21 -
2024-07-19		 a year crt.sh
*.alocdn.com
Go Daddy Secure Certificate Authority - G2		 2023-02-02 -
2024-03-05		 a year crt.sh
*.appspot.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.w55c.net
Amazon RSA 2048 M02		 2023-05-29 -
2024-06-25		 a year crt.sh
t.co
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-10-16 -
2024-10-14		 a year crt.sh
*.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-19 -
2024-09-17		 a year crt.sh
*.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.bttrack.com
Sectigo RSA Domain Validation Secure Server CA		 2023-04-04 -
2024-04-21		 a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2023-02-13 -
2024-03-15		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2023-02-02 -
2024-03-03		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2022-11-30 -
2024-01-01		 a year crt.sh
tr.blismedia.com
GTS CA 1D4		 2023-10-04 -
2024-01-02		 3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1		 2023-08-29 -
2024-08-29		 a year crt.sh
*.id5-sync.com
R3		 2023-11-01 -
2024-01-30		 3 months crt.sh
adentifi.com
Amazon RSA 2048 M01		 2023-07-06 -
2024-08-03		 a year crt.sh
*.intentiq.com
Amazon RSA 2048 M02		 2023-04-11 -
2024-05-08		 a year crt.sh
tags.wdsvc.net
Go Daddy Secure Certificate Authority - G2		 2023-10-18 -
2024-11-01		 a year crt.sh
odc-pixel-prod-01.oracle.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-07 -
2024-02-08		 a year crt.sh
a.clarity.ms
Microsoft Azure TLS Issuing CA 06		 2023-02-13 -
2024-02-08		 a year crt.sh

This page contains 39 frames:

Primary Page: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Frame ID: 49D284564B39706252DA65ED8C139220
Requests: 191 HTTP requests in this frame

Frame: https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
Frame ID: 22B96CBBB6C069F5C4D8C422EE12BE6E
Requests: 11 HTTP requests in this frame

Frame: https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
Frame ID: 25DEC33101E9F993C85FC1BCFA73C1AC
Requests: 30 HTTP requests in this frame

Frame: https://352c44ae8e3132a9bf53d7913c134ad8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: ED5DC0D5A88DA12B7BF54F0CD6F85C42
Requests: 1 HTTP requests in this frame

Frame: https://subs.theepochtimes.com/template/show?tid=signin&sid=www.theepochtimes.com&v=6&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=EET%20-%20Responsive%20Signin%20Bar&theme=default
Frame ID: 9F48742BD1C897A3846837B78DAA5785
Requests: 3 HTTP requests in this frame

Frame: https://securegames.iwin.com/m/console/v_313/
Frame ID: 980FAC501812C696174E496E569E69E5
Requests: 21 HTTP requests in this frame

Frame: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Frame ID: 5433CD8983B69CF348468BB7C2FFA878
Requests: 8 HTTP requests in this frame

Frame: https://subs.theepochtimes.com/template/show?tid=9b52e988-2c2d-4f6a-9c92-69faaf11c36a&sid=www.theepochtimes.com&v=22&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=Organic%20RW&rs=1&variantName=Games-0821-desktop&primary_category=epochfun-137957%3Bpuzzle-games-152300%3Bjoypass-free-155614%3Bspecial-epoch-games-155638%3Bbrain-games-156107%3Bfeatured-special-epoch-games-157768%3Bphoto-games-158540%3Bepochfun-premium-166969%3Bfrontaudio-161329
Frame ID: F4C13FF919DB45B827B5AB0E96F7D1E4
Requests: 6 HTTP requests in this frame

Frame: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Frame ID: 19C1F91AE8282AC12B7A360A00F6EC5A
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: D553759C4E470F54A5BB0A9004AAF525
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 3D125C4C8DDFF15DEA63AF125579C666
Requests: 2 HTTP requests in this frame

Frame: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Frame ID: C830FCD7F47628D4C38E9C5CB24C1E23
Requests: 63 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1701272584464
Frame ID: 2E8D90CC101544A72493F7B0C5C0E0CD
Requests: 1 HTTP requests in this frame

Frame: https://cdn.undertone.com/js/usersync.html
Frame ID: B612946064C200344D9BF2D0B736301B
Requests: 8 HTTP requests in this frame

Frame: https://cdn.undertone.com/js/usersync.html
Frame ID: 2FC461A392DE93F8F5BA1E2639018200
Requests: 8 HTTP requests in this frame

Frame: https://sdk.minutemedia-prebid.com/cs-config/cs.html?org=6475aa705b23100001019b46&tc=6475aaf65fe06700018e50d8&as=6475aaf65fe06700018e50da&type=hb&wd=cs.minutemedia-prebid.com&domain=theepochtimes.com
Frame ID: 5B5355E4ABA7C0560198BC2B46035B80
Requests: 6 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1701272584481
Frame ID: F217EDBE614EB2DAE4798EBE4D1E3D0C
Requests: 1 HTTP requests in this frame

Frame: https://cdn.undertone.com/js/usersync.html
Frame ID: F0CAF7F76B0310340CC72A7272132F4D
Requests: 8 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1701272584463
Frame ID: 453978613E1CE39118AC713454F3C32C
Requests: 1 HTTP requests in this frame

Frame: https://cdn.undertone.com/js/usersync.html
Frame ID: D7D9BA7B3C216479C43B1B2E024A0E12
Requests: 8 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1701272584774
Frame ID: 1C937A9B46FCA2363B84A1080CF8B197
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1701272584487
Frame ID: D32E0A6F8C9ED59F0DF8A4097D8CA7D7
Requests: 1 HTTP requests in this frame

Frame: https://cdn.undertone.com/js/usersync.html
Frame ID: 0223A85F0C16FAA811471993EBD34339
Requests: 8 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Frame ID: 962C0D1F97E13E514F7D280A83BBD098
Requests: 10 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=12776
Frame ID: 7A7914363AC2B171EA81BECF8B0E300E
Requests: 20 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Frame ID: F7A38E8A83F0C0ED274CD5F3EA8D9E46
Requests: 10 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=12776
Frame ID: 6F3936910E9120B6487DB53319BD3033
Requests: 19 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Frame ID: A37D20E343D46DF09B88E40D2D494297
Requests: 10 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=12776
Frame ID: 8C0D9633E450B3BFE37A5BC5FCCAEBFB
Requests: 18 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Frame ID: 3E0B7F4C11138F755C12082F59CD5476
Requests: 10 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=12776
Frame ID: 649220A328887BFE4A27D81BD07C42E2
Requests: 19 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Frame ID: 8216BFCE24D067818D71686140B8AB9A
Requests: 10 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=12776
Frame ID: 31D538DB33E2AA8899E108C7840387F8
Requests: 19 HTTP requests in this frame

Frame: https://accounts.google.com/gsi/button?type=icon&shape=square&theme=outline&text=signin_with&size=small&client_id=238531725567-d93kvm0isfq740t15a0btdc3m4gq8lif.apps.googleusercontent.com&iframe_id=gsi_587291_690295&as=f2yarsxrRZ2lMXqrXDu8oQ
Frame ID: C50EF7E9C018ADF45FD847C4DCA96BBD
Requests: 2 HTTP requests in this frame

Frame: https://accounts.google.com/gsi/button?type=standard&shape=rectangular&theme=outline&text=signin_with&size=small&logo_alignment=left&client_id=238531725567-d93kvm0isfq740t15a0btdc3m4gq8lif.apps.googleusercontent.com&iframe_id=gsi_587304_198312&as=f2yarsxrRZ2lMXqrXDu8oQ
Frame ID: 234995C62CA3EB043F7A8488E9DBC867
Requests: 2 HTTP requests in this frame

Frame: https://accounts.google.com/gsi/button?type=icon&shape=square&theme=outline&text=signin_with&size=small&client_id=238531725567-d93kvm0isfq740t15a0btdc3m4gq8lif.apps.googleusercontent.com&iframe_id=gsi_587305_413926&as=f2yarsxrRZ2lMXqrXDu8oQ
Frame ID: 8E39154933871214A6EEFA8B2E01B344
Requests: 2 HTTP requests in this frame

Frame: https://accounts.google.com/gsi/button?type=icon&shape=square&theme=outline&text=signin_with&size=small&client_id=238531725567-d93kvm0isfq740t15a0btdc3m4gq8lif.apps.googleusercontent.com&iframe_id=gsi_587306_189314&as=f2yarsxrRZ2lMXqrXDu8oQ
Frame ID: F378C6980C699444797D2A51DBD8651E
Requests: 2 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=765b4e6bb9c8438&gdpr=0&gdpr_consent=
Frame ID: 972A97C8C73428920355D2E69CFE02C3
Requests: 1 HTTP requests in this frame

Frame: https://cti.w55c.net/ct/cms-2c-rubicon.html
Frame ID: F3C87471BF1BB2207DFC027A076D1EC6
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Spot the Difference Daily- Play Now online & 100% Free | The Epoch Times

Detected technologies

Overall confidence: 100%
Detected patterns
  • accounts\.google\.com/gsi/client
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • require.*\.js
Overall confidence: 100%
Detected patterns
  • addthis\.com/js/
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • googletagservices\.com/tag/js/gpt(?:_mobile)?\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • /polyfill\.min\.js
Overall confidence: 100%
Detected patterns
  • /prebid\.js
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)
Overall confidence: 100%
Detected patterns
  • clientcdn\.pushengage\.\w+/core
Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • ([\d.]+)/jquery-ui(?:\.min)?\.js
  • jquery-ui.*\.js

Page Statistics

562
Requests

71 %
HTTPS

25 %
IPv6

130
Domains

185
Subdomains

125
IPs

11
Countries

5944 kB
Transfer

17258 kB
Size

174
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13
  • https://unpkg.com/web-streams-polyfill/dist/polyfill.min.js HTTP 302
  • https://unpkg.com/web-streams-polyfill@3.2.1/dist/polyfill.min.js
Request Chain 178
  • https://securegames.iwin.com/data/gtm.json HTTP 301
  • https://m.iwin.com/online-games
Request Chain 211
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/855967303/?random=5882597&cv=11&fst=1701272585875&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&label=HsWbCMacxuUDEMeMlJgD&hn=www.googleadservices.com&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&value=0&auid=1153095268.1701272584&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=ClxnZYddodT27w_PrrSADQ&sscte=1&crd=&eitems=ChAIgN-bqwYQ8ImJ5M24qtINEh0AkK_A4oD6Ve7VnZ1I5OQPr32CTgW0Ws14wwzxoQ&pscrd=Ek9DaEVJZ04tYnF3WVF5TW45NXUtMzhQdUxBUkltQVBjeVZCWlVtUGkzeThUaE8xcDcwOEdsSENIbkhLcm5Qenl2LVFyUnJoYThXZ2JMOWFFGlhDaEFJZ04tYnF3WVE3dV9WaTktWHBlVkJFaTRBNTV1dy1IRmJlOTVsLXc2bDZoZ2I1Z0NPc3BLUGh4U2lacHRzTDVDbnBKNUZRS2tXSXdUNzdDNzQzUjBkIhMIh4qfocbpggMVIar9Bx1PFw3Q HTTP 302
  • https://www.google.com/pagead/1p-conversion/855967303/?random=5882597&cv=11&fst=1701272585875&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&label=HsWbCMacxuUDEMeMlJgD&hn=www.googleadservices.com&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&value=0&auid=1153095268.1701272584&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ04tYnF3WVF5TW45NXUtMzhQdUxBUkltQVBjeVZCWlVtUGkzeThUaE8xcDcwOEdsSENIbkhLcm5Qenl2LVFyUnJoYThXZ2JMOWFFGlhDaEFJZ04tYnF3WVE3dV9WaTktWHBlVkJFaTRBNTV1dy1IRmJlOTVsLXc2bDZoZ2I1Z0NPc3BLUGh4U2lacHRzTDVDbnBKNUZRS2tXSXdUNzdDNzQzUjBkIhMIh4qfocbpggMVIar9Bx1PFw3Q&is_vtc=1&ocp_id=ClxnZYddodT27w_PrrSADQ&cid=CAQSKQDICaaN4TtIZMt2-VOgwCub4zIZzPVbVT2EfvSDbZ8uf3O0d8vzu_Hk&eitems=ChAIgN-bqwYQ8ImJ5M24qtINEh0AkK_A4kbb5gGZYw7MUQaPRCN6R0w2KRvtnGdJmQ&random=3191106765 HTTP 302
  • https://www.google.ch/pagead/1p-conversion/855967303/?random=5882597&cv=11&fst=1701272585875&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&label=HsWbCMacxuUDEMeMlJgD&hn=www.googleadservices.com&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&value=0&auid=1153095268.1701272584&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ04tYnF3WVF5TW45NXUtMzhQdUxBUkltQVBjeVZCWlVtUGkzeThUaE8xcDcwOEdsSENIbkhLcm5Qenl2LVFyUnJoYThXZ2JMOWFFGlhDaEFJZ04tYnF3WVE3dV9WaTktWHBlVkJFaTRBNTV1dy1IRmJlOTVsLXc2bDZoZ2I1Z0NPc3BLUGh4U2lacHRzTDVDbnBKNUZRS2tXSXdUNzdDNzQzUjBkIhMIh4qfocbpggMVIar9Bx1PFw3Q&is_vtc=1&ocp_id=ClxnZYddodT27w_PrrSADQ&cid=CAQSKQDICaaN4TtIZMt2-VOgwCub4zIZzPVbVT2EfvSDbZ8uf3O0d8vzu_Hk&eitems=ChAIgN-bqwYQ8ImJ5M24qtINEh0AkK_A4kbb5gGZYw7MUQaPRCN6R0w2KRvtnGdJmQ&random=3191106765&ipr=y
Request Chain 274
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Request Chain 275
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776 HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=12776
Request Chain 276
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=20e97b69-8983-47e8-91e3-9f94fbeabe97
Request Chain 277
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 301
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Request Chain 279
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTO1-1I-BB72
Request Chain 280
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RTYzN0Y2QTYtNEQzMC00QjhFLUE3MzEtNThEMjg4MTE0NkQ3&gdpr=-1&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7BUS_PRIVACY%7D HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Request Chain 281
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&ct=y HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Request Chain 282
  • https://ups.analytics.yahoo.com/ups/58545/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
Request Chain 284
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=4985e05f-f2a9-4c40-9567-3ee80d931ab3
Request Chain 285
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 301
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Request Chain 287
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTO2-1K-L57O
Request Chain 288
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTEyNDNFODAtRTdBMy00NTk2LTg4QTEtNjNFNUVGNUMyMzJE&gdpr=-1&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7BUS_PRIVACY%7D HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Request Chain 289
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&ct=y HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Request Chain 290
  • https://ups.analytics.yahoo.com/ups/58545/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
Request Chain 291
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Request Chain 292
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776 HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=12776
Request Chain 293
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=5c3095b4-3a34-41bb-a2ce-dc5a5c9a0c8a
Request Chain 294
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 301
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Request Chain 296
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOC-Y-J8CK
Request Chain 297
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QkMzRTE5MDctQTlDMC00MTgyLThFQTktMEJGMDk5M0U1QTNF&gdpr=-1&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7BUS_PRIVACY%7D HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Request Chain 298
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&ct=y HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Request Chain 299
  • https://ups.analytics.yahoo.com/ups/58545/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
Request Chain 300
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Request Chain 301
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776 HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=12776
Request Chain 302
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=20e97b69-8983-47e8-91e3-9f94fbeabe97
Request Chain 303
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 301
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Request Chain 305
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOM-1F-L42F
Request Chain 306
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MDZDNDQxNUYtMkJBQy00MjlGLTlEMDMtOERBODY3MzA4QTlC&gdpr=-1&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7BUS_PRIVACY%7D HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Request Chain 307
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&ct=y HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Request Chain 308
  • https://ups.analytics.yahoo.com/ups/58545/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-yyvHb7FE2uHD9V7Z7qO_e9LB_bkQhg5NSChsZN8-~A
Request Chain 309
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Request Chain 310
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776 HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=12776
Request Chain 311
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=f258318d-56c5-4dae-b3a1-fbd90b93292b
Request Chain 312
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 301
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Request Chain 314
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
Request Chain 315
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Qjk5QzA0MjItNTI4Qi00RjU5LUE3QUEtQkQ0NDA0Qzk0QzQ0&gdpr=-1&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7BUS_PRIVACY%7D HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Request Chain 316
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348%26partner_url%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D54%2526uid%253Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&ct=y HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3Df676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Request Chain 317
  • https://ups.analytics.yahoo.com/ups/58545/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true HTTP 302
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
Request Chain 318
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Request Chain 319
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776 HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=12776
Request Chain 329
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcC14uS3.iD3DAYpf7EwAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1&google_hm=2
Request Chain 331
  • https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZWdcCxphSIpZvWf7y-DLDgAA%265285&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 303
  • https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZWdcCxphSIpZvWf7y-DLDgAA%265285&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=722f175b673640ec93b4fd134ef576e0 HTTP 303
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@ HTTP 302
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g HTTP 303
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Request Chain 332
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCxphSIpZvWf7y_DLDgAAFKUAAAIB&gpp=&gpp_sid= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCxphSIpZvWf7y_DLDgAAFKUAAAIB&gpp=&gpp_sid=&dcc=t
Request Chain 334
  • https://p.rfihub.com/cm?in=1&pub=2079 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5107433831282994715
Request Chain 335
  • https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Request Chain 336
  • https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1716997387&external_user_id=75608216-8d33-459b-8783-54e4d5df9632
Request Chain 339
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcCwgujNemO8dxf6yPZgAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
Request Chain 340
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZWdcC14uS3-iD3DAYpf7EwAACHQAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
Request Chain 341
  • https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZWdcC14uS3.iD3DAYpf7EwAA%262164&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 303
  • https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZWdcC14uS3.iD3DAYpf7EwAA%262164&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=9f15a3c8a7c744fa8e1632cdc7c60e98 HTTP 303
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@ HTTP 302
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g HTTP 303
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Request Chain 342
  • https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8325801272123076523&gdpr=0&gdpr_consent=
Request Chain 343
  • https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=jOtXCY-9UVyX6FAOjrtMWtznWAqXvFMP2OmaheWc
Request Chain 344
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=ZWdcCwADQpy1QABU HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZWdcCwADQpy1QABU&_test=ZWdcCwADQpy1QABU
Request Chain 345
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_ HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_ HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=oDjxqhXq1R8mIr5
Request Chain 347
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZWdcCyJJNKYq5stdvyoBHQAADP8AAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
Request Chain 348
  • https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZWdcCyJJNKYq5stdvyoBHQAA%263327&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 303
  • https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZWdcCyJJNKYq5stdvyoBHQAA%263327&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=2ee7e4fa4e994c268a6bf9ac3f8e0eed HTTP 303
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@ HTTP 302
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g HTTP 303
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Request Chain 349
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcC-sXacToKX2bjE7h3AAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
Request Chain 351
  • https://sync.srv.stackadapt.com/sync?nid=68 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
Request Chain 353
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48 HTTP 302
  • https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=
Request Chain 357
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCwgujNemO8dxf6yPZgAAFE0AAAIB&gpp=&gpp_sid= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCwgujNemO8dxf6yPZgAAFE0AAAIB&gpp=&gpp_sid=&dcc=t
Request Chain 358
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcC-sXacToKX2bjE7h3AAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
Request Chain 359
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZWdcCwgujNemO8dxf6yPZgAAFE0AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
Request Chain 360
  • https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 307
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=261f5beb-0718-478a-9ff7-4afd0eca556a&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
Request Chain 361
  • https://match.adsby.bidtheatre.com/indexmatch?gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcCwgujNemO8dxf6yPZgAA%265197 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?gdpr=&gdpr_consent=&cm_dsp_id=226&external_user_id=bf9086ab-e8ba-45bb-90be-499af4372459
Request Chain 362
  • https://sync.srv.stackadapt.com/sync?nid=68 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
Request Chain 363
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_ HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_ HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=oDjxqhXq1R8mIr5
Request Chain 365
  • https://rp.liadm.com/j?dtstmp=1701272587322&se=e30&duid=57b4458eb59c--01hgdvz2xx52zhtpkasf60wjrm&tna=v2.11.1&pu=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&wpn=lc-bundle HTTP 302
  • https://rp4.liadm.com/j?se=e30&duid=57b4458eb59c--01hgdvz2xx52zhtpkasf60wjrm&tna=v2.11.1&dtstmp=1701272587322&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&i6=MmEwNTphZDAwOmI6MDoxMjU6OjE%3D
Request Chain 366
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZWdcC_sXacToKX2bjE7h3AAAFLQAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
Request Chain 367
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcC-sXacToKX2bjE7h3AAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
Request Chain 368
  • https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZWdcC-sXacToKX2bjE7h3AAA%265300&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 303
  • https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZWdcC-sXacToKX2bjE7h3AAA%265300&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=f08cbe7d17b34a069150cbe9bbf902e2 HTTP 303
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@ HTTP 302
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g HTTP 303
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Request Chain 369
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcC_sXacToKX2bjE7h3AAAFLQAAAIB&gpp=&gpp_sid= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcC_sXacToKX2bjE7h3AAAFLQAAAIB&gpp=&gpp_sid=&dcc=t
Request Chain 371
  • https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Request Chain 372
  • https://sync.srv.stackadapt.com/sync?nid=68 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
Request Chain 373
  • https://creativecdn.com/cm-notify?pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcC-sXacToKX2bjE7h3AAA%265300 HTTP 302
  • https://creativecdn.com/cm-notify?pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcC-sXacToKX2bjE7h3AAA%265300&tc=1 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=ZrEOATwDRZeH2qy9kwJoIfG3y9rXUKsCHuV6WSFm9hI&pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcC-sXacToKX2bjE7h3AAA%265300&tc=1
Request Chain 381
  • https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21480%26id%3D$UID HTTP 302
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21480%26id%3D%24UID HTTP 302
  • https://cs.minutemedia-prebid.com/cs?aid=21480&id=431352185976743711462
Request Chain 383
  • https://bh.contextweb.com/bh/rtset?pid=562963&ev=1&us_privacy=[US_PRIVACY]&gdpr=0&gdpr_consent=&rurl=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21494%26id%3D%25%25VGUID%25%25 HTTP 302
  • https://cs.minutemedia-prebid.com/cs?aid=21494&id=6Eba1g0IjY3t&ev=1&us_privacy=[US_PRIVACY]&pid=562963&gdpr_consent=&gdpr=0
Request Chain 384
  • https://ssbsync.smartadserver.com/api/sync?callerId=59&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.minutemedia-prebid.com/cs?aid=21498&id=8109155695714381815&gdpr=0&gdpr_consent=
Request Chain 391
  • https://a.remarketstats.com/px/smart/?c=244b81b94c69796&seg=epochfun/spot-the-difference-daily-3956489 HTTP 302
  • https://a.clickcertain.com/px/smart/a/?seg=epochfun/spot-the-difference-daily-3956489&c=244b81b94c69796 HTTP 302
  • https://a.clickcertain.com/px/?c=244b81b94c69796
Request Chain 394
  • https://tags.wdsvc.net/controller.js?id=100415 HTTP 302
  • https://tags.wdsvc.net/container.js?id=100415&v=4.10&t=1701272587768
Request Chain 397
  • https://sb.scorecardresearch.com/b?c1=2&c2=24003086&ns__t=1701272587463&ns_c=UTF-8&c8=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&c7=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=24003086&ns__t=1701272587463&ns_c=UTF-8&c8=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&c7=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&c9=
Request Chain 398
  • https://sb.scorecardresearch.com/c2/24003086/cs.js HTTP 302
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
Request Chain 405
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776&khaos=LPJXRTOQ-N-6ZRW HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
Request Chain 421
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/cvtiwsBoANbINg2ZgB56pg?csrc= HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-g33_PpZE2oKPCquAJzkMFncv0nLbG7cmI_fWkg--~A
Request Chain 423
  • https://pixel.rubiconproject.com/exchange/sync.php?p=a9us HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=LPJXRTOQ-N-6ZRW&ex=d-rubiconproject.com&status=ok
Request Chain 424
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id= HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=AvxQqwWuS-CJtktPCCH6GA&rk=usync-other HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=AvxQqwWuS-CJtktPCCH6GA
Request Chain 425
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPHNxgdaIf8oTboOri6iZYc&google_cver=1
Request Chain 426
  • https://token.rubiconproject.com/token?pid=36584 HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPJXRTOQ-N-6ZRW
Request Chain 427
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=cRFLMGS8T42hPPQ12yVpqQ&rk=usync-na HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=cRFLMGS8T42hPPQ12yVpqQ
Request Chain 428
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFBKWFJUT1EtTi02WlJX HTTP 302
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENP3WfCipIEuk5lVIaJ1oTM&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBKWFJUT1EtTi02WlJX&google_push=
Request Chain 429
  • https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NWIwNjc3MmNjZTRmNWZjMWM4NTk5MDdlZjIyZDljODhkZWY3YzEwYw
Request Chain 430
  • https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp HTTP 303
  • https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&_bee_ppp=1 HTTP 303
  • https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAD_007KzrgAABRHedWbqg&expires=30
Request Chain 431
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn HTTP 302
  • https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
Request Chain 432
  • https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn HTTP 302
  • https://ce.lijit.com/merge?pid=80&3pid=LPJXRTOQ-N-6ZRW
Request Chain 433
  • https://pixel.rubiconproject.com/exchange/sync.php?p=primis HTTP 302
  • https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LPJXRTOQ-N-6ZRW
Request Chain 434
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx HTTP 302
  • https://prebid.a-mo.net/setuid/magnite?uid=LPJXRTOQ-N-6ZRW
Request Chain 435
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=2e121d07-9736-44ed-b08e-9137df2b6ccd&expires=30
Request Chain 436
  • https://pixel.rubiconproject.com/exchange/sync.php?p=19564 HTTP 302
  • https://capi.connatix.com/us/pixel?puid=LPJXRTOQ-N-6ZRW&pId=11&gdpr=&gdpr_consent=&us_privacy= HTTP 302
  • https://capi.connatix.com/us/pixel?puid=LPJXRTOQ-N-6ZRW&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
Request Chain 437
  • https://token.rubiconproject.com/token?pid=37556&a=1 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LPJXRTOQ-N-6ZRW HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=LPJXRTOQ-N-6ZRW
Request Chain 438
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LPJXRTOQ-N-6ZRW&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=58160&ovsid=LPJXRTOQ-N-6ZRW&redir=true HTTP 302
  • https://hb.yahoo.net/cksync?cs=63&axid_e=eS0uZGhVZ0RaRTJ1RXdvQVJmaWF0Nl9DR1gzcTJmVkpLVX5B&ovsid=LPJXRTOQ-N-6ZRW&dpid=58160
Request Chain 439
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LPJXRTOQ-N-6ZRW
Request Chain 440
  • https://pixel.rubiconproject.com/exchange/sync.php?p=seedtag HTTP 302
  • https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LPJXRTOQ-N-6ZRW
Request Chain 442
  • https://sync.srv.stackadapt.com/sync?nid=14 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=Ol13Km9rW5N_haph2upMcrnDR9k
Request Chain 443
  • https://c1.adform.net/serving/cookie/match?party=1164 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=1164 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=3199104349002520066
Request Chain 444
  • https://dis.criteo.com/dis/usersync.aspx?r=6&p=70&cp=Rubicon&cu=1&url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D6434%26nid%3D2149%26put%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=b96e9db1-3894-42bb-b605-10b056c02dc6
Request Chain 445
  • https://ad.turn.com/r/cs?pid=6 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=8094047327731269571&expires=60&gdpr=&gdpr_consent=
Request Chain 447
  • https://sync.1rx.io/usersync2/rubicon HTTP 302
  • https://sync.1rx.io/usersync2/rubicon?zcc=1&cb=1701272587908 HTTP 302
  • https://ad.turn.com/r/cs?pid=45&rndcb=144604005 HTTP 302
  • https://sync.1rx.io/usersync/turn/8166104921769197507?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-c7b9ee18-5405-4b53-9cd4-cf4ab127c5c1-003?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D186028%26nid%3D4112%26put%3DRX-c7b9ee18-5405-4b53-9cd4-cf4ab127c5c1-003%26expires%3D30 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-c7b9ee18-5405-4b53-9cd4-cf4ab127c5c1-003&expires=30
Request Chain 449
  • https://pixel.rubiconproject.com/exchange/sync.php?p=adyoulike HTTP 302
  • https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPJXRTOQ-N-6ZRW&name=RUBICON
Request Chain 450
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly HTTP 302
  • https://sync.1rx.io/usersync/rubicon/LPJXRTOQ-N-6ZRW HTTP 302
  • https://sync.1rx.io/usersync/rubicon/LPJXRTOQ-N-6ZRW?zcc=1&cb=1701272587935 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-2ee79b4d-6e9f-4a7e-859b-9ddbfe984d29-003
Request Chain 451
  • https://pixel.rubiconproject.com/exchange/sync.php?p=rise_engage HTTP 302
  • https://cs.yellowblue.io/cs?aid=11590&id=LPJXRTOQ-N-6ZRW
Request Chain 452
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17404 HTTP 302
  • https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LPJXRTOQ-N-6ZRW
Request Chain 453
  • https://token.rubiconproject.com/token?pid=49096 HTTP 302
  • https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LPJXRTOQ-N-6ZRW HTTP 303
  • https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LPJXRTOQ-N-6ZRW
Request Chain 454
  • https://pixel.rubiconproject.com/exchange/sync.php?p=minute_media HTTP 302
  • https://cs.minutemedia-prebid.com/cs?aid=21479&id=LPJXRTOQ-N-6ZRW
Request Chain 455
  • https://pixel.rubiconproject.com/exchange/sync.php?p=33across HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=1&xu=LPJXRTOQ-N-6ZRW
Request Chain 456
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-triple13 HTTP 302
  • https://s2s.t13.io/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
Request Chain 458
  • https://pixel.rubiconproject.com/exchange/sync.php?p=outbrain HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LPJXRTOQ-N-6ZRW&obUid=&initiator=
Request Chain 459
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=ZWdcCwADQpy1QABU
Request Chain 460
  • https://um.simpli.fi/rb_match HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=D2CB47E4AB91487CBCDB48C9EEE02968&expires=365
Request Chain 463
  • https://token.rubiconproject.com/token?pid=2046&pt=n&a=1 HTTP 302
  • https://rubicon-match.dotomi.com/match/bounce/current?networkId=12783&version=1&nuid=L2uoynzTJmrcX0mFezNCOA HTTP 302
  • https://rubicon-match.dotomi.com/match/bounce/current?DotomiTest=58b5e8911052170a&is_secure=true&networkId=12783&version=1&nuid=L2uoynzTJmrcX0mFezNCOA HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAAHvbrPtqGxAwN4cOmEAAAAAAA&expiration=1701358988&nuid=L2uoynzTJmrcX0mFezNCOA&is_secure=true
Request Chain 464
  • https://pixel.rubiconproject.com/exchange/sync.php?p=11864 HTTP 302
  • https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LPJXRTOQ-N-6ZRW
Request Chain 465
  • https://bh.contextweb.com/bh/rtset?pid=560687&ev=1&rurl=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D390200%26nid%3D5120%26put%3D%25%25VGUID%25%25 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=390200&nid=5120&put=6Eba1g0IjY3t&ev=1&pid=560687
Request Chain 466
  • https://a.tribalfusion.com/i.match?p=b10&u={rubicon_user_token}&redirect=https%3A//pixel.rubiconproject.com/tap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180 HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b10&u={rubicon_user_token}&redirect=https%3A//pixel.rubiconproject.com/tap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180
Request Chain 467
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776 HTTP 302
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
Request Chain 468
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-medianet HTTP 302
  • https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
Request Chain 469
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17184 HTTP 302
  • https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LPJXRTOQ-N-6ZRW
Request Chain 470
  • https://dsp.adfarm1.adition.com/cookie/?ssp=7 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=101732&nid=3822&put=7306910122771347601&expires=730
Request Chain 471
  • https://pixel.rubiconproject.com/exchange/sync.php?p=yieldmo HTTP 302
  • https://ads.yieldmo.com/sync?pn_id=rc&id=LPJXRTOQ-N-6ZRW
Request Chain 472
  • https://pixel.rubiconproject.com/exchange/sync.php?p=smartadserver HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=104&partneruserid=LPJXRTOQ-N-6ZRW
Request Chain 473
  • https://ums.acuityplatform.com/tum?umid=2 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=5672&nid=2082&put=858191110320&expires=30&us_privacy=1---
Request Chain 474
  • https://b1sync.zemanta.com/usersync/rubicon/ HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=144598&nid=3992&expires=30&put=
Request Chain 475
  • https://pixel.rubiconproject.com/exchange/sync.php?p=loopme HTTP 302
  • https://csync.loopme.me/?partner_id=1441&vt=&uid=LPJXRTOQ-N-6ZRW
Request Chain 476
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17136_2 HTTP 302
  • https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LPJXRTOQ-N-6ZRW
Request Chain 477
  • https://rbp.mxptint.net/sn.ashx HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R35CAB_10CE9DDD0_40041FD0&expires=60
Request Chain 478
  • https://pixel.rubiconproject.com/exchange/sync.php?p=24856 HTTP 302
  • https://e.serverbid.com/usersync?cn=5529&ttt=1&dpui=LPJXRTOQ-N-6ZRW
Request Chain 480
  • https://cms.quantserve.com/pixel/p-e4m3Yko6bFYVc.gif?idmatch=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=uwRn17hSYYKgB2DQuVR8hOsIaNSgU2PR7wb3SAz2
Request Chain 481
  • https://pixel.rubiconproject.com/exchange/sync.php?p=epsilon HTTP 302
  • https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LPJXRTOQ-N-6ZRW
Request Chain 482
  • https://ssbsync.smartadserver.com/api/sync?callerId=87 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=333994&nid=4804&put=8325801272123076523&gdpr=0&gdpr_consent=
Request Chain 483
  • https://match.adsby.bidtheatre.com/rubiconmatch HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=17039&nid=2650&days=30&gdpr=&gdpr_consent=&put=bf9086ab-e8ba-45bb-90be-499af4372459
Request Chain 484
  • https://x.bidswitch.net/sync?ssp=rubicon HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=rubicon HTTP 302
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=rubicon&bsw_custom_parameter=703c8abe-24c7-4b70-aa60-bbf93e93964e HTTP 302
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=rubicon&bsw_custom_parameter=703c8abe-24c7-4b70-aa60-bbf93e93964e HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=66271bd1-5204-4bab-902d-e29bf870fd9b&user_group=1&ssp=rubicon&bsw_param=703c8abe-24c7-4b70-aa60-bbf93e93964e HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=15796&nid=2760&put=703c8abe-24c7-4b70-aa60-bbf93e93964e&expires=30&gdpr=&gdpr_consent=&us_privacy=
Request Chain 485
  • https://s.company-target.com/s/rp HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=1181926&nid=5578&put=75608216-8d33-459b-8783-54e4d5df9632
Request Chain 486
  • https://tg.socdm.com/rtb/sync?proto=rubicon HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=71722&nid=3668&expires=30&put=ZWdcDMCo5tEAAK97Ji4AAAAA
Request Chain 487
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16466 HTTP 302
  • https://usync.vrtcal.com/o?xs=1624&did=LPJXRTOQ-N-6ZRW
Request Chain 489
  • https://sid.storygize.net/ccm/729e4e94-63c3-438d-8ce4-184eb34e703f HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=1172318&nid=5570&put=37cf273d-6031-4a9e-b4c2-17b86d952301
Request Chain 490
  • https://p.rfihub.com/cm?in=1&pub=64 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=5107433831282994715&expires=30
Request Chain 491
  • https://sync.smartadserver.com/getuid?gdpr=0&url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D32128%26nid%3D2915%26put%3D[sas_uid] HTTP 302
  • https://sync.smartadserver.com/getuid?gdpr=0&url=https://pixel.rubiconproject.com/tap.php?v=32128&nid=2915&put=[sas_uid]&cklb=1
Request Chain 492
  • https://dmp.brand-display.com/cm/api/rubicon HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=538100&nid=5446&put=8cc7d1e1-12b3-b56f-4c073297
Request Chain 493
  • https://onetag-sys.com/match/?int_id=4 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=
Request Chain 495
  • https://sync.adotmob.com/cookie/rubicon?r=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D123034%26nid%3D3956%26put%3D%7Buser_token%7D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=123034&nid=3956&put=09db220400841804b79b2b59&expires=1
Request Chain 496
  • https://beacon.lynx.cognitivlabs.com/rb.gif HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=711370&nid=5504&put=7bc850e3-be78-4ae0-a1cc-36d2632af28c&expires=365&next=https%3A%2F%2Fbeacon.lynx.cognitivlabs.com%2Fpixel%3Ftype%3Dsync%26source%3Drubicon%26inventory_source%3D0 HTTP 302
  • https://beacon.lynx.cognitivlabs.com/pixel?type=sync&source=rubicon&inventory_source=0 HTTP 302
  • https://pixel.rubiconproject.com/token?pid=49038&puid=7bc850e3-be78-4ae0-a1cc-36d2632af28c
Request Chain 498
  • https://rubiconcm.digitaleast.mobi/usersync/rubicon.gif HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=600424&nid=5498&put=04c563ba-b4b3-421f-ac65-2dadcc3f07a0
Request Chain 499
  • https://um4.eqads.com/um/rc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=11598&nid=2494&put=f9aac181-5916-4a6c-8bfe-4da28fe814aa&expires=30
Request Chain 500
  • https://cm.smadex.com/sync?sm_p=rbc&sm_r=rbc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=71194&nid=3636&put=2cb3d839-a303-43e0-8534-af27e78e4830&expires=30
Request Chain 504
  • https://p.alocdn.com/c/6irth52s/a/etarget/p.gif?title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&auid=a634b748-2bfc-4ac8-9408-aee689913aec HTTP 302
  • https://p.alocdn.com/c/6irth52s/a/etarget/p.gif?title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&auid=a634b748-2bfc-4ac8-9408-aee689913aec&tdc=1
Request Chain 507
  • https://p.alocdn.com/c/vn3d8u2u/a/etarget/p.gif?label=5N0H11N-collect-%257B%2522script%2522%253A%2522https%253A%252F%252Fs3-us-west-2.amazonaws.com%252Fjsstore%252Fa%252F5n0h11n%252Fge.js%2522%252C%2522ver%2522%253A%25221.6.1%2522%252C%2522guid%2522%253A%2522021f82a7-7f5e-4152-9436-2d1f2f09c23c%2522%257D&title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489 HTTP 302
  • https://p.alocdn.com/c/vn3d8u2u/a/etarget/p.gif?label=5N0H11N-collect-%257B%2522script%2522%253A%2522https%253A%252F%252Fs3-us-west-2.amazonaws.com%252Fjsstore%252Fa%252F5n0h11n%252Fge.js%2522%252C%2522ver%2522%253A%25221.6.1%2522%252C%2522guid%2522%253A%2522021f82a7-7f5e-4152-9436-2d1f2f09c23c%2522%257D&title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tdc=1
Request Chain 512
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=52A27B8A52C340B9933BA603A3F847EF&RedC=c.clarity.ms&MXFR=3325B116AB7D682B3537A2CEAF7D66C4 HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=52A27B8A52C340B9933BA603A3F847EF&MUID=0C206B455AD768603F6F789D5B8C69FF
Request Chain 513
  • https://pm.w55c.net/m.gif?rurl=//cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=_wfivefivec64esc_&google_cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=b0RqeHFoWHExUjhtSXI1&google_cm HTTP 302
  • https://tags.w55c.net/match-result?id=8bb138bc0446417c9a4df9a0136d0caf8a93328592bf4d059bfc856c256fbc33&ei=GOOGLE&euid=&google_gid=CAESEJFtejrTUPNl2fU4Rw3MRBc&google_cver=1

562 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request spot-the-difference-daily-3956489
www.theepochtimes.com/epochfun/ 		278 KB
28 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Next.js
Resource Hash
d728d838bf7568e84833439cc194e79dd411f4f952a96096bd2f2cc91c56729e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

cache-control
private, no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
EXPIRED
cf-ray
82dbf6c8cac72294-CDG
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 29 Nov 2023 15:43:03 GMT
last-modified
Wed, 29 Nov 2023 11:26:53 GMT
server
cloudflare
vary
RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Url, Accept-Encoding
x-powered-by
Next.js
0e4fe491bf84089c-s.p.woff2
www.theepochtimes.com/_next/static/media/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/media/0e4fe491bf84089c-s.p.woff2
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44

Request headers

Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Origin
https://www.theepochtimes.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:15 GMT
server
cloudflare
age
412
etag
"6560c673-2b20"
vary
Accept-Encoding
content-type
font/woff2
accept-ranges
bytes
cf-ray
82dbf6cd38dc2294-CDG
content-length
11040
6bb7340ca2af5689-s.p.woff2
www.theepochtimes.com/_next/static/media/ 		169 KB
169 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/media/6bb7340ca2af5689-s.p.woff2
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85b0a6b7e1a39cfab0b46283acb187039816c087dba5d16b7e64f78ee59a1137

Request headers

Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Origin
https://www.theepochtimes.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:13 GMT
server
cloudflare
age
412
etag
"6560c671-2a2f0"
vary
Accept-Encoding
content-type
font/woff2
accept-ranges
bytes
cf-ray
82dbf6cd38de2294-CDG
content-length
172784
934c4b7cb736f2a3-s.p.woff2
www.theepochtimes.com/_next/static/media/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/media/934c4b7cb736f2a3-s.p.woff2
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f

Request headers

Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Origin
https://www.theepochtimes.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:15 GMT
server
cloudflare
age
412
etag
"6560c673-2b14"
vary
Accept-Encoding
content-type
font/woff2
accept-ranges
bytes
cf-ray
82dbf6cd38e12294-CDG
content-length
11028
9abce57f69036a9f-s.p.woff2
www.theepochtimes.com/_next/static/media/ 		117 KB
117 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/media/9abce57f69036a9f-s.p.woff2
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4551991444bea767a97af5120479bd3b786c29a14498dc3e13a8ea3a029dced

Request headers

Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Origin
https://www.theepochtimes.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
cf-cache-status
REVALIDATED
last-modified
Fri, 24 Nov 2023 15:51:20 GMT
server
cloudflare
etag
"6560c678-1d45c"
vary
Accept-Encoding
content-type
font/woff2
accept-ranges
bytes
cf-ray
82dbf6cd38e92294-CDG
content-length
119900
e30f558d8fc3e992.css
www.theepochtimes.com/_next/static/css/ 		182 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/css/e30f558d8fc3e992.css
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7cb0ca1dd12fa46486a944429eae07a90c13403ccd57566f8ab948eadf0ffc55

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:04 GMT
server
cloudflare
age
453
etag
W/"65590d74-2d941"
vary
Accept-Encoding
content-type
text/css
cf-ray
82dbf6cd38e22294-CDG
b8604733e03d8f28.css
www.theepochtimes.com/_next/static/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/css/b8604733e03d8f28.css
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4fbdb5935b28450589b76b53bb1c5d0234d14de6b66173ffc6e38b91d1b1db3

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
last-modified
Fri, 24 Nov 2023 15:51:13 GMT
server
cloudflare
etag
W/"6560c671-d13"
vary
Accept-Encoding
content-type
text/css
cf-ray
82dbf6cd38e42294-CDG
53fa15469dc309b1.css
www.theepochtimes.com/_next/static/css/ 		2 KB
640 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/css/53fa15469dc309b1.css
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16ca3aa97c894d331e7f3dadaee8f7ac8a66a30fc1f85c877bdca4cd911ef520

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
last-modified
Fri, 24 Nov 2023 15:51:15 GMT
server
cloudflare
etag
W/"6560c673-851"
vary
Accept-Encoding
content-type
text/css
cf-ray
82dbf6cd38e62294-CDG
webpack-0d96dcb645945e00.js
www.theepochtimes.com/_next/static/chunks/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d75e8f5e4b97a7b003c317c52b8f6587b9616e0f53a909b783c3f8663414619a

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:15 GMT
server
cloudflare
age
453
etag
W/"65590d7f-1396"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6cd38ea2294-CDG
1dd3208c-0d71712ce0edec8f.js
www.theepochtimes.com/_next/static/chunks/ 		157 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/1dd3208c-0d71712ce0edec8f.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93c87f976cf92a16c0de1912a209b8a1d5e85fe70057222b149f4b3852ebeaed

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:17 GMT
server
cloudflare
age
453
etag
W/"6560c675-27404"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6cd38eb2294-CDG
3575-2d836e85a2302404.js
www.theepochtimes.com/_next/static/chunks/ 		99 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/3575-2d836e85a2302404.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d94f1a39acfe37b82ee50c1db98885a2fca89e81ca7850294df2dbde1f76972c

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:15 GMT
server
cloudflare
age
453
etag
W/"6560c673-18d9d"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6cd38ef2294-CDG
main-app-8802373399b59a02.js
www.theepochtimes.com/_next/static/chunks/ 		429 B
316 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/main-app-8802373399b59a02.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad5f6dda15141642e04d54d4ef048c6be955d9adcc5fb4a9704674c9ec71c356

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:11 GMT
server
cloudflare
age
453
etag
W/"65590d7b-1ad"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6cd691e2294-CDG
grumi-ip.js
rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.26.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-26-75.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ccf7b12ecc8e9e8ffdde253ba24560e0b8742463ad4868c7659fc90968ffcb3a

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:21:37 GMT
x-amz-version-id
XHKJxLIyRvnhzGSgMnr2SKD4F8gK0HK7
content-encoding
br
last-modified
Thu, 09 Nov 2023 17:31:54 GMT
server
AmazonS3
via
1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P7
etag
W/"4c4f4bf824d2aa120a5e0b665b4c9828"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=14400, stale-while-revalidate=14400, immutable
age
1287
x-amz-cf-id
Nm2rLUVG47Z-OuO32plZDcz23ZZqbf29-lWrp9SOwSQuQbAAbRlkTQ==
polyfill.min.js
polyfill.io/v3/ 		101 B
618 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polyfill.io/v3/polyfill.min.js?features=Intl%2CResizeObserver%2CIntersectionObserver
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:800::282 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 29 Nov 2023 15:43:03 GMT
age
5145
detected-user-agent
Chrome/89.0.4389
server-timing
HIT-CLUSTER, fastly;desc="Edge time";dur=2
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
120
referrer-policy
origin-when-cross-origin
vary
User-Agent, Accept-Encoding
access-control-allow-methods
GET,HEAD,OPTIONS
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
normalized-user-agent
chrome/89.0.0
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800, immutable
accept-ranges
bytes
timing-allow-origin
*
polyfill.min.js
unpkg.com/web-streams-polyfill@3.2.1/dist/
Redirect Chain
  • https://unpkg.com/web-streams-polyfill/dist/polyfill.min.js
  • https://unpkg.com/web-streams-polyfill@3.2.1/dist/polyfill.min.js
59 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/web-streams-polyfill@3.2.1/dist/polyfill.min.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e3530366f481c19813abb79fd15cdc5b45dbbc276401cbde7c4bf283b75a114
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
2444109
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01HE512MRG405RWCZP4WJMRW70-cdg
server
cloudflare
etag
W/"ec4a-HUydLHWFwqUMHRHMwTGDjElD3/c"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
82dbf6ce18e8f1ac-CDG

Redirect headers

date
Wed, 29 Nov 2023 15:43:03 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01HGDVSN3AMGMMH5SZQJPEX6CQ-cdg
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
174
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
location
/web-streams-polyfill@3.2.1/dist/polyfill.min.js
cache-control
public, s-maxage=600, max-age=60
cf-ray
82dbf6cdb858f1ac-CDG
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		91 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f8cec560b6492c537272ade85fb140485f4d0e49c1bec8270d6c34244ddf8e25
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30073
x-xss-protection
0
server
cafe
etag
619 / 19690 / m202311150101 / config-hash: 2176564774933884501
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Wed, 29 Nov 2023 15:43:03 GMT
prebid.js
www.theepochtimes.com/assets/themes/eet/js/ 		278 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7210db5c299a856c7f10c854485deaf0e274d963cefa8694a26f513fdad6f436
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Sat, 16 Sep 2023 19:22:59 GMT
server
cloudflare
x-microcachable
0
age
412
etag
W/"65060093-458a4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
82dbf6cd691f2294-CDG
x-device
desktop
x-xss-protection
1; mode=block
js
www.googletagmanager.com/gtag/ 		279 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-RD0QM5H02Q
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a01ff83777fd7b5566fbd0f49f273fb949fa62c946bf8b68c8569f88676a6c21
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
94156
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 29 Nov 2023 15:43:03 GMT
api.bundle.js
subs.theepochtimes.com/lib/ 		368 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
b7123bf5d1742985950f5f6ab3845907263a91e175527eb11baae5f45c3735a9

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 03 Nov 2023 19:11:33 GMT
server
nginx/1.20.1
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
max-age=3600, public, no-transform
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 29 Nov 2023 16:43:03 GMT
epoch_mparticle.min.js
services.epoch.cloud/public-labs/epoch-ai/mparticle/built/ 		36 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://services.epoch.cloud/public-labs/epoch-ai/mparticle/built/epoch_mparticle.min.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bfbcf9db364dcc67523b25da3243f768613963345d4d661a24afe82c20d38f0a

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Nov 2023 18:05:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
799
etag
W/"65662bcd-9008"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wkwxxvGgJsr6gqM6qSLAbruuqgY4rE5FikV8AS3xn07kiw9kV%2Bdur7PNHe2xYCq69GdRXZWU1nzRWa15YDhKbSAIpSAPc0RswfcTrZpeRVmJk6mkYo0VDH9ty5QehWkbrTpa2HucXKUnKOLSgAqpPmN1zg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400
cf-ray
82dbf6cd9f1383a0-MXP
alt-svc
h3=":443"; ma=86400
template.css
subs.theepochtimes.com/lib/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/lib/template.css
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2f009a44aa057e608440849ba7d59135c178393165207fb8268d1680f9365b5b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 03 Nov 2023 19:11:33 GMT
server
nginx/1.20.1
vary
Accept-Encoding
content-type
text/css; charset=UTF-8
cache-control
max-age=3600, public, no-transform
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1242
expires
Wed, 29 Nov 2023 16:43:03 GMT
email-decode.min.js
www.theepochtimes.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
830 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 27 Nov 2023 12:56:30 GMT
server
cloudflare
etag
W/"656491fe-4d7"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
82dbf6cd69222294-CDG
expires
Fri, 01 Dec 2023 15:43:03 GMT
application-client.js
entertainment.service.amuniversal.com/assets/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://entertainment.service.amuniversal.com/assets/application-client.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.151 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
8d797b58dbbb90837bff92450e25c5a0fc90040116e51311437d9f2c4f03c94b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Nov 2020 18:20:09 GMT
ETag
"8d797b58dbbb90837bff92450e25c5a0fc90040116e51311437d9f2c4f03c94b"
Vary
Accept-Encoding
Content-Type
application/javascript
Status
200 OK
Cache-Control
public,max-age=600
Connection
Keep-Alive
Keep-Alive
timeout=5, max=19
Content-Length
7846
menuSearch.9968d4ed.svg
www.theepochtimes.com/_next/static/media/ 		685 B
400 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theepochtimes.com/_next/static/media/menuSearch.9968d4ed.svg
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e5fbbe10f708bf6bbcc9d5d91e7209391cf9798e3ac144d3dd3db2c2e698309

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
last-modified
Fri, 24 Nov 2023 15:51:17 GMT
server
cloudflare
etag
W/"6560c675-2ad"
vary
Accept-Encoding
content-type
image/svg+xml
cf-ray
82dbf6d05cc62294-CDG
logo.32553ed2.svg
www.theepochtimes.com/_next/static/media/ 		16 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theepochtimes.com/_next/static/media/logo.32553ed2.svg
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86ec2da6a4b0444953187ebca1373c7eee98813073fd5ce9046739d006220e5d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
last-modified
Fri, 24 Nov 2023 15:51:17 GMT
server
cloudflare
etag
W/"6560c675-3f08"
vary
Accept-Encoding
content-type
image/svg+xml
cf-ray
82dbf6d05cc92294-CDG
image
www.theepochtimes.com/_next/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theepochtimes.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2FEpochFun_logo.bbb08190.png&w=640&q=75
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c9d20a82bcd631dba5fb5a9c1dbc507baf559da09375e65b8870a328fc6e470
Security Headers
Name Value
Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox;

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-security-policy
script-src 'none'; frame-src 'none'; sandbox;
cf-cache-status
EXPIRED
server
cloudflare
etag
LJ0gqCvNYx26X7WpwdvFB7r1WdoJN15luIcKMo-G5HA=
vary
Accept, Accept-Encoding
content-type
image/webp
x-nextjs-cache
HIT
cache-control
public, max-age=315360000, immutable
content-disposition
inline; filename="EpochFun_logo.webp"
accept-ranges
bytes
cf-ray
82dbf6d05cca2294-CDG
content-length
4408
copy_link.1f77f7a1.svg
www.theepochtimes.com/_next/static/media/ 		591 B
420 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theepochtimes.com/_next/static/media/copy_link.1f77f7a1.svg
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26596e242c76558f8085c3d3a634ff993bc7ff98cdfb6d322bb7698c420e6bfe

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:13 GMT
server
cloudflare
age
452
etag
W/"6560c671-24f"
vary
Accept-Encoding
content-type
image/svg+xml
cf-ray
82dbf6d05ccb2294-CDG
facebook_icon.abf2c2c3.svg
www.theepochtimes.com/_next/static/media/ 		617 B
448 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theepochtimes.com/_next/static/media/facebook_icon.abf2c2c3.svg
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3bccf2ba4483214a64dd5d4222b45ae474f5d51bbc50bc80e7c78445e621772

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
last-modified
Fri, 24 Nov 2023 15:51:20 GMT
server
cloudflare
etag
W/"6560c678-269"
vary
Accept-Encoding
content-type
image/svg+xml
cf-ray
82dbf6d05ccc2294-CDG
x.772c500c.svg
www.theepochtimes.com/_next/static/media/ 		650 B
469 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theepochtimes.com/_next/static/media/x.772c500c.svg
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c79b952455a77dfa6e4dbf3474e887a4a6cccf285881103803651bf408b4b16a

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
last-modified
Fri, 24 Nov 2023 15:51:13 GMT
server
cloudflare
etag
W/"6560c671-28a"
vary
Accept-Encoding
content-type
image/svg+xml
cf-ray
82dbf6d05ccd2294-CDG
iwin-spot-the-difference-daily
entertainment.service.amuniversal.com/content/ Frame 22B9 		10 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/assets/application-client.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.151 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
9b105bfdc2a196ea90a25be8ab4c6764be3be930601ed42aa3e12092373c4765
Security Headers
Name Value
X-Frame-Options ALLOWALL

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Cache-Control
max-age=0, private, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
3513
Content-Type
text/html; charset=utf-8
Date
Wed, 29 Nov 2023 15:43:03 GMT
ETag
W/"9b105bfdc2a196ea90a25be8ab4c6764-gzip"
Keep-Alive
timeout=5, max=84
Status
200 OK
Vary
Accept-Encoding
X-Frame-Options
ALLOWALL
X-Request-Id
ffccb3b0-8b5a-4e29-8aab-92b07714a8cd
image
www.theepochtimes.com/_next/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theepochtimes.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2FEET_footer.d4ea1157.png&w=384&q=75
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9a63d5248095b6078fd95a59c270efae7d1cc086d9911533010bfd6555482f96
Security Headers
Name Value
Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox;

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-security-policy
script-src 'none'; frame-src 'none'; sandbox;
cf-cache-status
EXPIRED
server
cloudflare
etag
mmPVJICVtgeP2VpZwnDvrn0cwIbZkRUzAQv9ZVVIL5Y=
vary
Accept, Accept-Encoding
content-type
image/webp
x-nextjs-cache
HIT
cache-control
public, max-age=315360000, immutable
content-disposition
inline; filename="EET_footer.webp"
accept-ranges
bytes
cf-ray
82dbf6d0bd3c2294-CDG
content-length
3846
668f0bba-02f16f3e7b11d0d2.js
www.theepochtimes.com/_next/static/chunks/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/668f0bba-02f16f3e7b11d0d2.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d08110fb32a9fa5e161050a13a7980c6db1bdfedbd3a09ea2b263c8520faa7f6

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:13 GMT
server
cloudflare
age
451
etag
W/"6560c671-152b4"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0cd612294-CDG
2360-01bd3076de6ca245.js
www.theepochtimes.com/_next/static/chunks/ 		19 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/2360-01bd3076de6ca245.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2012cd4f45b6daba14c597f96666b2bdb074046bb7816bed9669a18c99c4ec0d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:15 GMT
server
cloudflare
age
451
etag
W/"6560c673-4bfb"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0cd622294-CDG
6486-f0809c28403df2c4.js
www.theepochtimes.com/_next/static/chunks/ 		52 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/6486-f0809c28403df2c4.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0175ef65c5d8cd4ce63c030a8c409a33f73de027b1593bf77f780f91c3b07bdd

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:15 GMT
server
cloudflare
age
451
etag
W/"6560c673-ce4e"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0cd632294-CDG
8302-fee83ca9f04bd764.js
www.theepochtimes.com/_next/static/chunks/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/8302-fee83ca9f04bd764.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85526a1f718fba197ba6c3bcbb062fbe6e0aa4dbff573484548218fa2eb43185

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:17 GMT
server
cloudflare
age
451
etag
W/"6560c675-2abc"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0cd652294-CDG
5684-0c8b4c954f662381.js
www.theepochtimes.com/_next/static/chunks/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/5684-0c8b4c954f662381.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bade9777ab933b6324666fedee893c4382b7ec482a10584ac9dd89a0fde3f768

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:20 GMT
server
cloudflare
age
451
etag
W/"6560c678-1876"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0cd662294-CDG
2948-dd10ac91a545a9b3.js
www.theepochtimes.com/_next/static/chunks/ 		66 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/2948-dd10ac91a545a9b3.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
04f8090b918995b61062ffc6ad531cc6cbfcf87e3fdddf999be58f3eab8f677f

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:11 GMT
server
cloudflare
age
451
etag
W/"65590d7b-108df"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fda32294-CDG
6894-dca972864df689ea.js
www.theepochtimes.com/_next/static/chunks/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/6894-dca972864df689ea.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8cb96c825619029e657cbc8ddb8c035814c868738cb667fc279b3cf3a218c920

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:15 GMT
server
cloudflare
age
451
etag
W/"65590d7f-43f5"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fda62294-CDG
9198-90af93414c71cb6d.js
www.theepochtimes.com/_next/static/chunks/ 		196 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/9198-90af93414c71cb6d.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ea8156a2defd83d0201fc63fee3f65908cdf7da8fbee7ad1ea5f6a2a982790e

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:04 GMT
server
cloudflare
age
451
etag
W/"65590d74-311f1"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fda72294-CDG
4528-a850e0bc071259b3.js
www.theepochtimes.com/_next/static/chunks/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/4528-a850e0bc071259b3.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a79e9fc14eb6b58fa3aa286664bea6e957bce0fcb705403a1a77aa65929250e1

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:07 GMT
server
cloudflare
age
451
etag
W/"65590d77-2c07"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fda82294-CDG
layout-5761fe05afb0d021.js
www.theepochtimes.com/_next/static/chunks/app/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/app/layout-5761fe05afb0d021.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8425353bac621a584b0fe8bb963ffb29af8a8790aabb71f0173111a9599be5f5

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:15 GMT
server
cloudflare
age
451
etag
W/"65590d7f-2928"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fda92294-CDG
6553-96f8b4e8332835b6.js
www.theepochtimes.com/_next/static/chunks/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/6553-96f8b4e8332835b6.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
064d7b833644dd282e4ab3ea2f965d8ec8d4cd6db6ab74c19d0e93df5bb6e823

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:17 GMT
server
cloudflare
age
451
etag
W/"6560c675-41b5"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdaa2294-CDG
5704-01f8a6fd6b337147.js
www.theepochtimes.com/_next/static/chunks/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/5704-01f8a6fd6b337147.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58255daa744ee7478e21dd58b685345e4f76d95522a5ba987c4e73e9281336c5

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:19 GMT
server
cloudflare
age
451
etag
W/"6560c677-32ca"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdab2294-CDG
5883-e98bf51814a383f6.js
www.theepochtimes.com/_next/static/chunks/ 		23 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/5883-e98bf51814a383f6.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83b1c226ddee3a6b6f78e8a3d84d9cf590a157642b0da6db5917b4adb9f4f162

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:13 GMT
server
cloudflare
age
451
etag
W/"6560c671-5c43"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdac2294-CDG
219-429aa3d853996862.js
www.theepochtimes.com/_next/static/chunks/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/219-429aa3d853996862.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
978d3ba4801394114df599b7401282e1e0ada60a155273078581c747c985dfaa

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:15 GMT
server
cloudflare
age
451
etag
W/"6560c673-484a"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdae2294-CDG
1389-695e1509e094ea70.js
www.theepochtimes.com/_next/static/chunks/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/1389-695e1509e094ea70.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b20fe750004499fdf135b5e7bd2608b33dfa417dd63dfafed5ee8e80e029ae2b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:07 GMT
server
cloudflare
age
303
etag
W/"65590d77-3efd"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdaf2294-CDG
layout-992a3522f92ab375.js
www.theepochtimes.com/_next/static/chunks/app/(featured-category)/ 		196 B
266 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/app/(featured-category)/layout-992a3522f92ab375.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d67edfce62f3f2a92258ccee1daf3e702d207f759f9dc65f11f18cf4f914b568

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 18 Nov 2023 19:16:07 GMT
server
cloudflare
age
279
etag
W/"65590d77-c4"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdb12294-CDG
1871-674dfdb3ab3673a3.js
www.theepochtimes.com/_next/static/chunks/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/1871-674dfdb3ab3673a3.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7561ec2dc82f7edac7a440ad46f72c7b09bc8f6c75a14f1ba391de945da9cb2f

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:13 GMT
server
cloudflare
age
279
etag
W/"6560c671-4c20"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdb22294-CDG
layout-535761bbdfeaa241.js
www.theepochtimes.com/_next/static/chunks/app/epochfun/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/app/epochfun/layout-535761bbdfeaa241.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c35947cc7611eef3295c9a61dc7cf129469eeae6eb8d34fb4b0dcecba82b556

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
last-modified
Sat, 18 Nov 2023 19:16:11 GMT
server
cloudflare
etag
W/"65590d7b-2ff6"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdb32294-CDG
page-f83ba42fb71f26d8.js
www.theepochtimes.com/_next/static/chunks/app/epochfun/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/app/epochfun/page-f83ba42fb71f26d8.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fbb804264bebba8187a2b9a504f4cc216e7a0aca9947e40f0b9554e734edd8d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
last-modified
Sat, 18 Nov 2023 19:16:11 GMT
server
cloudflare
etag
W/"65590d7b-20b1"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdb42294-CDG
931-c785358ff576a023.js
www.theepochtimes.com/_next/static/chunks/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/931-c785358ff576a023.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2217ed3c72b72b9496411a601e38bb2dc1520f0cbd840576541e1ef89a3eb730

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:13 GMT
server
cloudflare
age
451
etag
W/"6560c671-1de9"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdb52294-CDG
6635-aaa70223b4b75abd.js
www.theepochtimes.com/_next/static/chunks/ 		21 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/6635-aaa70223b4b75abd.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
30ee8dc4920b2dca6621737d57c70ab1dff3b54c52001d9488d2cf048c99c3c3

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:03 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:13 GMT
server
cloudflare
age
451
etag
W/"6560c671-53a6"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdb62294-CDG
184-87611bec7c2cf695.js
www.theepochtimes.com/_next/static/chunks/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/184-87611bec7c2cf695.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4491b5b57d925f8936741639493af09c09be16d13906e9582d8589bcf3f80ac

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
last-modified
Sat, 18 Nov 2023 19:16:15 GMT
server
cloudflare
etag
W/"65590d7f-3c4b"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdb72294-CDG
page-8a831bfb4c1c93f9.js
www.theepochtimes.com/_next/static/chunks/app/epochfun/%5Burl%5D/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/app/epochfun/%5Burl%5D/page-8a831bfb4c1c93f9.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/webpack-0d96dcb645945e00.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3bc7de8e39808225af0f8680e5df920d386b053b329123b5bd7e8ff6a820aaa3

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
last-modified
Sat, 18 Nov 2023 19:16:15 GMT
server
cloudflare
etag
W/"65590d7f-1e5c"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d0fdba2294-CDG
application-uu-79b8bc5284ce122857feca100bbb6d6ed8c6b96bb7942a276e418e30a466f74c.css
entertainment.service.amuniversal.com/assets/ Frame 22B9 		256 KB
33 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://entertainment.service.amuniversal.com/assets/application-uu-79b8bc5284ce122857feca100bbb6d6ed8c6b96bb7942a276e418e30a466f74c.css
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.151 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
b260521dc91bb9be40d0cb9e8ae37b39c94703b68d7d29cbcd5aad0922665a83

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:04 GMT
Content-Encoding
gzip
Last-Modified
Wed, 16 Feb 2022 22:25:13 GMT
ETag
"3fed0-5d82a1f8b4440-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
33843
theme-plugins-f1fc7fe6169405625fd46a53184cbfae4e50f0dd9923ee73abba444a738a4b4a.css
entertainment.service.amuniversal.com/assets/ Frame 22B9 		52 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://entertainment.service.amuniversal.com/assets/theme-plugins-f1fc7fe6169405625fd46a53184cbfae4e50f0dd9923ee73abba444a738a4b4a.css
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.151 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
c62298477bd42f1c46d68b84e392835c73934351c1575fc42e913a5ea0500e42

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:04 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Nov 2020 18:28:00 GMT
ETag
"cec4-5b5572b7dcc00-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=13
Content-Length
8026
application-uu-f2acbdedb9ab48db13e574a4f5010c5a867cd4ba1f014bae3ad6dcc246e82580.js
entertainment.service.amuniversal.com/assets/ Frame 22B9 		229 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://entertainment.service.amuniversal.com/assets/application-uu-f2acbdedb9ab48db13e574a4f5010c5a867cd4ba1f014bae3ad6dcc246e82580.js
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.151 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
f2acbdedb9ab48db13e574a4f5010c5a867cd4ba1f014bae3ad6dcc246e82580

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:04 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Nov 2020 18:28:01 GMT
ETag
"39238-5b5572b8d0e40-gzip"
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
application-uu-postload-043f156b36cbe9177181059747715ccc59cfeee710c5a6bbe53aa37929991710.js
entertainment.service.amuniversal.com/assets/ Frame 22B9 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://entertainment.service.amuniversal.com/assets/application-uu-postload-043f156b36cbe9177181059747715ccc59cfeee710c5a6bbe53aa37929991710.js
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.151 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
043f156b36cbe9177181059747715ccc59cfeee710c5a6bbe53aa37929991710

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:04 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Nov 2020 18:20:09 GMT
ETag
"eaf-5b5570f6ae840-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
1513
region
pwe.epochbase.com/ 		155 B
354 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pwe.epochbase.com/region?siteId=www.theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/6894-dca972864df689ea.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.110.129.224 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
224.129.110.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
40952936a556d52b3b78b310a5ba4d1ab4ff92e4d4ebc28b239f81263c118464

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
155
gtm.js
www.googletagmanager.com/ 		271 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5Z8H4H
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f3d75d455699a9dfeaff6b790a794ba938bc7c5e2109cfb85b273804c2641f89
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
94039
x-xss-protection
0
last-modified
Wed, 29 Nov 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 29 Nov 2023 15:43:04 GMT
grumi.js
rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/ 		220 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.26.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-26-75.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6486dc0dd88f16d057de0089d5d280dd337fe701d214fe983e8a5296b547ef23

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:21:39 GMT
x-amz-version-id
q7zqv.uEOfOJikhhuTCVfETBlbbOohyX
content-encoding
br
last-modified
Wed, 29 Nov 2023 15:20:04 GMT
server
AmazonS3
via
1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P7
etag
W/"c110f54d29d688f94293c6e6e7a34a5b"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
age
1286
x-amz-cf-id
74C3zDnCKbuzlBguOLPUe8ZoD9bhvaJdZ3iDRyNPYbMpXuVveP9UNQ==
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/ 		431 KB
135 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b033f59e4ffeaa6f3e4f2e839c035a14811d5469d3f772eda6056d7d5782c53f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:17:58 GMT
content-encoding
br
x-content-type-options
nosniff
age
1506
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
138149
x-xss-protection
0
server
cafe
etag
11558412289700915514
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Thu, 28 Nov 2024 15:17:58 GMT
hb-mm-multi
hb.minutemedia-prebid.com/ 		696 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.30.181.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-30-181-208.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
e9a6914e67d57334b8d67d9c707347897fef6034f24b9a3fa7051314666a41f3

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
server
istio-envoy
x-reason
filterByBL0Supply: filtered all imps
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://www.theepochtimes.com
content-type
application/json
access-control-allow-credentials
true
x-envoy-upstream-service-time
5
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length
696
prebid-request
onetag-sys.com/ 		15 B
418 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/prebid-request
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

strict-transport-security
max-age=15552000
content-encoding
gzip
content-type
application/json
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control
no-transform, no-cache
access-control-allow-credentials
true
access-control-allow-headers
content-type, origin, referer, user-agent
content-length
41
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
v1
hb-api.omnitagjs.com/hb-api/prebid/ 		179 B
703 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&CanonicalUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&PublisherDomain=https%3A%2F%2Fwww.theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.210.49.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-49-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ad24663c62bcfab5cf179832fa7a087741361e97c292b601e4ca45d3ec14221d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
via
kong/2.8.4
x-content-type-options
nosniff
x-kong-proxy-latency
0
p3p
CP="CAO PSA OUR"
x-kong-upstream-latency
42
content-length
179
pragma
no-cache
access-control-max-age
3600
access-control-allow-methods
OPTIONS, POST
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
vary
Accept-Encoding
access-control-allow-headers
Accept-Encoding, Content-Type
expires
0
hb
hb.undertone.com/ 		0
523 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.undertone.com/hb?pid=3017&domain=theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-40.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
via
1.1 50cfe0dc07dec77718bfa8346e608936.cloudfront.net (CloudFront)
accept-ch
sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-pop
MUC50-P3
x-cache
Miss from cloudfront
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin
https://www.theepochtimes.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
x-amz-cf-id
CFThQx__t9ahFs5P0PDXiEwXCs_G4Rzn2PQpKR5Byp-tJHp6nj9Kew==
expires
Mon, 26 Jul 1997 05:00:00 GMT
prebid
exchange.postrelease.com/ 		0
396 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://exchange.postrelease.com/prebid?ntv_pb_rid=9c03bd9607c2d7&ntv_ppc=eyJhZFVuaXRzIjpbeyJhZFVuaXRDb2RlIjoiZ2FtZV90b3BfYWRfNzI4eDkwIiwibWVkaWFUeXBlcyI6eyJiYW5uZXIiOnsic2l6ZXMiOltbOTcwLDI1MF0sWzk3MCw5MF0sWzcyOCw5MF1dfX19XX0=&ntv_dbr=eyJnYW1lX3RvcF9hZF83Mjh4OTAiOjB9&ntv_url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.22.251.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-22-251-49.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
server
nginx/1.12.2
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials
true
content-length
20
expires
Mon, 1 Jan 1990 12:00:00 GMT
prebid
exchange.postrelease.com/ 		0
396 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://exchange.postrelease.com/prebid?ntv_pb_rid=11d8fd5cc950808&ntv_ppc=eyJhZFVuaXRzIjpbeyJhZFVuaXRDb2RlIjoiZ2FtZV90b3BfYWRfMzAweDI1MCIsIm1lZGlhVHlwZXMiOnsiYmFubmVyIjp7InNpemVzIjpbWzMwMCwyNTBdXX19fV19&ntv_dbr=eyJnYW1lX3RvcF9hZF83Mjh4OTAiOjAsImdhbWVfdG9wX2FkXzMwMHgyNTAiOjB9&ntv_url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.22.251.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-22-251-49.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
server
nginx/1.12.2
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials
true
content-length
20
expires
Mon, 1 Jan 1990 12:00:00 GMT
hb
hb.undertone.com/ 		0
523 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.undertone.com/hb?pid=3017&domain=theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-40.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
via
1.1 50cfe0dc07dec77718bfa8346e608936.cloudfront.net (CloudFront)
accept-ch
sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-pop
MUC50-P3
x-cache
Miss from cloudfront
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin
https://www.theepochtimes.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
x-amz-cf-id
KQjAzxtgMFbnyyHQOCBCiUjhIh4k1e-KJmmYhWfjQXlHppIhVyXbuA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
prebid-request
onetag-sys.com/ 		15 B
417 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/prebid-request
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

strict-transport-security
max-age=15552000
content-encoding
gzip
content-type
application/json
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control
no-transform, no-cache
access-control-allow-credentials
true
access-control-allow-headers
content-type, origin, referer, user-agent
content-length
41
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
hb-mm-multi
hb.minutemedia-prebid.com/ 		696 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.30.181.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-30-181-208.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
fdbad68e620cf08924f47ee9dba928382d4f1eb8adf7988d3807aa7f507a6efd

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
server
istio-envoy
x-reason
filterByBL0Supply: filtered all imps
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://www.theepochtimes.com
content-type
application/json
access-control-allow-credentials
true
x-envoy-upstream-service-time
24
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length
696
v1
hb-api.omnitagjs.com/hb-api/prebid/ 		180 B
703 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&CanonicalUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&PublisherDomain=https%3A%2F%2Fwww.theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.210.49.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-49-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
6a871c9bac54dd086c8423a9948bf0ee32a23002e010f97f8b0ba473bdd7b452
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
via
kong/2.8.4
x-content-type-options
nosniff
x-kong-proxy-latency
0
p3p
CP="CAO PSA OUR"
x-kong-upstream-latency
97
content-length
180
pragma
no-cache
access-control-max-age
3600
access-control-allow-methods
OPTIONS, POST
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
vary
Accept-Encoding
access-control-allow-headers
Accept-Encoding, Content-Type
expires
0
prebid
exchange.postrelease.com/ 		0
397 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://exchange.postrelease.com/prebid?ntv_pb_rid=2105036977bf8f1&ntv_ppc=eyJhZFVuaXRzIjpbeyJhZFVuaXRDb2RlIjoiZ2FtZV9yaWdodF90b3BfYWRfMzAweDYwMCIsIm1lZGlhVHlwZXMiOnsiYmFubmVyIjp7InNpemVzIjpbWzMwMCwyNTBdLFszMDAsNjAwXV19fX1dfQ==&ntv_dbr=eyJnYW1lX3RvcF9hZF83Mjh4OTAiOjAsImdhbWVfdG9wX2FkXzMwMHgyNTAiOjAsImdhbWVfcmlnaHRfdG9wX2FkXzMwMHg2MDAiOjB9&ntv_url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.22.251.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-22-251-49.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
server
nginx/1.12.2
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials
true
content-length
20
expires
Mon, 1 Jan 1990 12:00:00 GMT
hb-mm-multi
hb.minutemedia-prebid.com/ 		696 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.30.181.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-30-181-208.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
ded9728e079116c2334f15330ad73001327dc2a1c8db43c946c5172c948e0a8e

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
server
istio-envoy
x-reason
filterByBL0Supply: filtered all imps
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://www.theepochtimes.com
content-type
application/json
access-control-allow-credentials
true
x-envoy-upstream-service-time
8
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length
696
v1
hb-api.omnitagjs.com/hb-api/prebid/ 		180 B
703 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&CanonicalUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&PublisherDomain=https%3A%2F%2Fwww.theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.210.49.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-49-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
4dde8fd8ff5489e2aeb8fa399da386611608d749e5577f7acf4ff46aa6e2438b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
via
kong/2.8.4
x-content-type-options
nosniff
x-kong-proxy-latency
0
p3p
CP="CAO PSA OUR"
x-kong-upstream-latency
81
content-length
180
pragma
no-cache
access-control-max-age
3600
access-control-allow-methods
OPTIONS, POST
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
vary
Accept-Encoding
access-control-allow-headers
Accept-Encoding, Content-Type
expires
0
prebid-request
onetag-sys.com/ 		15 B
417 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/prebid-request
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

strict-transport-security
max-age=15552000
content-encoding
gzip
content-type
application/json
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control
no-transform, no-cache
access-control-allow-credentials
true
access-control-allow-headers
content-type, origin, referer, user-agent
content-length
41
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
hb
hb.undertone.com/ 		0
521 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.undertone.com/hb?pid=3017&domain=theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-40.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
via
1.1 50cfe0dc07dec77718bfa8346e608936.cloudfront.net (CloudFront)
accept-ch
sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-pop
MUC50-P3
x-cache
Miss from cloudfront
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin
https://www.theepochtimes.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
x-amz-cf-id
cxUT0pbyyUj1MRG1LcVGgMbG7Mop9uf1c-iybqur6VdKVtsvBkkN3Q==
expires
Mon, 26 Jul 1997 05:00:00 GMT
prebid-request
onetag-sys.com/ 		15 B
417 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/prebid-request
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

strict-transport-security
max-age=15552000
content-encoding
gzip
content-type
application/json
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control
no-transform, no-cache
access-control-allow-credentials
true
access-control-allow-headers
content-type, origin, referer, user-agent
content-length
41
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
hb-mm-multi
hb.minutemedia-prebid.com/ 		696 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.30.181.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-30-181-208.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
969ae449cbf09db3f280f57f8825ad388fcac6eba0d68a4d2ac5cfc46cc955ee

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
server
istio-envoy
x-reason
filterByBL0Supply: filtered all imps
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://www.theepochtimes.com
content-type
application/json
access-control-allow-credentials
true
x-envoy-upstream-service-time
5
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length
696
prebid
exchange.postrelease.com/ 		0
396 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://exchange.postrelease.com/prebid?ntv_pb_rid=35e3c37d7657f8e&ntv_ppc=eyJhZFVuaXRzIjpbeyJhZFVuaXRDb2RlIjoiZ2FtZV9yaWdodF9ib3R0b21fYWRfMzAweDI1MCIsIm1lZGlhVHlwZXMiOnsiYmFubmVyIjp7InNpemVzIjpbWzMwMCwyNTBdXX19fV19&ntv_dbr=eyJnYW1lX3RvcF9hZF83Mjh4OTAiOjAsImdhbWVfdG9wX2FkXzMwMHgyNTAiOjAsImdhbWVfcmlnaHRfdG9wX2FkXzMwMHg2MDAiOjAsImdhbWVfcmlnaHRfYm90dG9tX2FkXzMwMHgyNTAiOjB9&ntv_url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.22.251.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-22-251-49.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
server
nginx/1.12.2
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials
true
content-length
20
expires
Mon, 1 Jan 1990 12:00:00 GMT
v1
hb-api.omnitagjs.com/hb-api/prebid/ 		180 B
702 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&CanonicalUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&PublisherDomain=https%3A%2F%2Fwww.theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.210.49.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-49-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e6671d84edbd24363471c068f8b96676940257cf02e911881fc18d6949a791c7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
via
kong/2.8.4
x-content-type-options
nosniff
x-kong-proxy-latency
0
p3p
CP="CAO PSA OUR"
x-kong-upstream-latency
51
content-length
180
pragma
no-cache
access-control-max-age
3600
access-control-allow-methods
OPTIONS, POST
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
vary
Accept-Encoding
access-control-allow-headers
Accept-Encoding, Content-Type
expires
0
hb
hb.undertone.com/ 		0
521 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.undertone.com/hb?pid=3017&domain=theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-40.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
via
1.1 50cfe0dc07dec77718bfa8346e608936.cloudfront.net (CloudFront)
accept-ch
sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-pop
MUC50-P3
x-cache
Miss from cloudfront
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin
https://www.theepochtimes.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
x-amz-cf-id
jPY_39l3uwW6cmqI2--9Q8LY9NceOkh9a68J8Js3wz59dZE2pka9JA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
/
comment.youmaker.com/web/v3/ Frame 25DE 		774 B
739 B 		Document
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/1dd3208c-0d71712ce0edec8f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
5ca92c06dc31883efdd21b50d74cfd8756fa7a312728339494e2298cb40b6a9f

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
app-name
remark
app-version
0.1.2
author
EMG
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 29 Nov 2023 15:43:04 GMT
last-modified
Fri, 20 Oct 2023 19:30:46 GMT
server
nginx/1.20.1
vary
Accept-Encoding
via
1.1 google
x-robots-tag
noindex
collect
region1.analytics.google.com/g/ 		0
258 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-RD0QM5H02Q&gtm=45je3b81v884763001&_p=1701272584324&_gaz=1&gcd=11l1l1l1l1&dma=0&cid=468256303.1701272584&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1701272584&sct=1&seg=0&dl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&dt=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&en=page_view&_fv=1&_nsi=1&_ss=1&_c=1&_ee=1&ep.eet_page_type=post&ep.all_term_ids=epochfun-137957%3Bpuzzle-games-152300%3Bjoypass-free-155614%3Bspecial-epoch-games-155638%3Bbrain-games-156107%3Bfeatured-special-epoch-games-157768%3Bphoto-games-158540%3Bepochfun-premium-166969%3Bfrontaudio-161329&ep.eet_cat_names=Epoch%20Fun%3BPuzzle%20Games%3BLatest%3BSpecial%3BBrain%20Games%3BFeatured%3BPhoto%20Games%3BEpochFun%20Premium&ep.eet_author_name=Epoch%20Puzzles&ep.eet_primary_category_name=Photo%20Games&epn.eet_post_id=3956489&tfd=1939
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RD0QM5H02Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
249 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-RD0QM5H02Q&cid=468256303.1701272584&gtm=45je3b81v884763001&aip=1&dma=0&gcd=11l1l1l1l1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RD0QM5H02Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c1f::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.ch/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ch/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-RD0QM5H02Q&cid=468256303.1701272584&gtm=45je3b81v884763001&aip=1&dma=0&gcd=11l1l1l1l1&z=850468768
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 29 Nov 2023 14:56:17 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
2807
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Wed, 29 Nov 2023 16:56:17 GMT
geo
subs.theepochtimes.com/rules/ 		114 B
132 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/rules/geo
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
62a15750a484370fd71813d636ea36a05425e1104a0e289aebb2dbbfb2849b65

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
114
analytics.js
www.google-analytics.com/ Frame 22B9 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://entertainment.service.amuniversal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 29 Nov 2023 14:56:17 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
2807
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Wed, 29 Nov 2023 16:56:17 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/717879253/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/717879253/?random=1701272584456&cv=11&fst=1701272584456&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&hn=www.googleadservices.com&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&auid=1153095268.1701272584&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
84c3113e3598c90572431f39b0563678912968c3e2616e42d757a09e7a2f1e28
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
main.7036b77e.js
comment.youmaker.com/web/v3/static/js/ Frame 25DE 		466 KB
149 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
c34e5d3266ea00298001d8d288f2772c0829a74b54b7687b683a3dcdd91a4d23

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 20 Oct 2023 19:30:46 GMT
server
nginx/1.20.1
author
EMG
vary
Accept-Encoding
app-name
remark
content-type
application/javascript
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
app-version
0.1.2
main.f8b20501.css
comment.youmaker.com/web/v3/static/css/ Frame 25DE 		300 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/web/v3/static/css/main.f8b20501.css
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
26334b6e9122b102cc66898bceee5be00927575ff5bce29907a7b35a94688f37

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 20 Oct 2023 19:30:46 GMT
server
nginx/1.20.1
author
EMG
vary
Accept-Encoding
app-name
remark
content-type
text/css; charset=utf-8
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
app-version
0.1.2
9489.d680c7df41a5be6f.js
www.theepochtimes.com/_next/static/chunks/ 		210 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theepochtimes.com/_next/static/chunks/9489.d680c7df41a5be6f.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:9d16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
884b2215f82d3eee559bbececf208a978c8167a2706da9b911492f4798b39537

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 24 Nov 2023 15:51:20 GMT
server
cloudflare
age
411
etag
W/"6560c678-34939"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
82dbf6d5dc742294-CDG
get
subs.theepochtimes.com/template/ 		185 B
203 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/template/get?tid=signin&sid=www.theepochtimes.com
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
d73f53d60e8d626b9238c3334cff2d2ad92d6228ed6b0131c6e2cf488948ca60

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
185
get
subs.theepochtimes.com/rules/ 		2 MB
245 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/rules/get?sid=www.theepochtimes.com&pid=4c14e06e-dead-4a19-833b-f676ae9d77da
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
ee339f73c8812e9efdcf61161b86d2fd646ce96c3ff214b5e496232d4b37d99f

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
via
1.1 google
server
nginx/1.20.1
vary
Accept-Encoding, Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
c
ea.epochbase.com/api/pw/ 		0
232 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ea.epochbase.com/api/pw/c?tid=P-KDJOIELE2&en=readactivity
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
4.7.168.74 White Haven, United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

access-control-allow-origin
https://www.theepochtimes.com
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
allow
GET, POST, OPTIONS, PUT, DELETE
access-control-allow-methods
GET, POST, OPTIONS, PUT, DELETE
c
ea.epochbase.com/api/pw/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://ea.epochbase.com/api/pw/c?tid=P-KDJOIELE2&en=readactivity
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
4.7.168.74 White Haven, United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Access-Control-Allow-Origin,Content-Type
access-control-allow-methods
GET, POST, PATCH, OPTIONS, PUT, DELETE
access-control-allow-origin
*
allow
GET, POST, OPTIONS, PUT, DELETE
content-length
0
date
Wed, 29 Nov 2023 15:43:04 GMT
server
nginx/1.20.1
/
www.google.com/pagead/1p-user-list/717879253/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/717879253/?random=1701272584456&cv=11&fst=1701270000000&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&fmt=3&is_vtc=1&cid=CAQSGwDICaaNVchFR_Xx-dn_A-kZIm27dS6-PfRF9A&random=469100274&rmt_tld=0&ipr=y
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ch/pagead/1p-user-list/717879253/ 		42 B
154 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ch/pagead/1p-user-list/717879253/?random=1701272584456&cv=11&fst=1701270000000&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&fmt=3&is_vtc=1&cid=CAQSGwDICaaNVchFR_Xx-dn_A-kZIm27dS6-PfRF9A&random=469100274&rmt_tld=1&ipr=y
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
config
mp.theepochtimes.com/tags/JS/v2/us2-c639a6aabfcf124097c91276dd5884fb/ 		8 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mp.theepochtimes.com/tags/JS/v2/us2-c639a6aabfcf124097c91276dd5884fb/config?env=0&plan_id=eet_data_plan
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/9198-90af93414c71cb6d.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Kestrel /
Resource Hash
37d1365b74f5ad68cedb786f57c8a2e108354f7494ebbd46dc3cbe2a0af5befe

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
219
x-origin-name
fastlyshield--shield_ssl_cache_iad_kcgs7200114_IAD
x-cache
HIT, MISS, HIT
content-length
1857
x-served-by
cache-iad-kcgs7200114-IAD, cache-mxp6981-MXP, cache-mxp6933-MXP
server
Kestrel
x-timer
S1701272585.742874,VS0,VE2
vary
Accept-Encoding
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600
accept-ranges
bytes
x-cache-hits
45, 0, 1
prebid-request
onetag-sys.com/ 		15 B
417 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/prebid-request
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

strict-transport-security
max-age=15552000
content-encoding
gzip
content-type
application/json
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control
no-transform, no-cache
access-control-allow-credentials
true
access-control-allow-headers
content-type, origin, referer, user-agent
content-length
41
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
prebid
exchange.postrelease.com/ 		0
396 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://exchange.postrelease.com/prebid?ntv_pb_rid=43d3780fb9e9752&ntv_ppc=eyJhZFVuaXRzIjpbeyJhZFVuaXRDb2RlIjoiZ2FtZV9ib3R0b21fYWRfNzI4eDkwIiwibWVkaWFUeXBlcyI6eyJiYW5uZXIiOnsic2l6ZXMiOltbOTcwLDI1MF0sWzk3MCw5MF0sWzcyOCw5MF1dfX19XX0=&ntv_dbr=eyJnYW1lX3RvcF9hZF83Mjh4OTAiOjAsImdhbWVfdG9wX2FkXzMwMHgyNTAiOjAsImdhbWVfcmlnaHRfdG9wX2FkXzMwMHg2MDAiOjAsImdhbWVfcmlnaHRfYm90dG9tX2FkXzMwMHgyNTAiOjAsImdhbWVfYm90dG9tX2FkXzcyOHg5MCI6MH0=&ntv_url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.22.251.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-22-251-49.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
server
nginx/1.12.2
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials
true
content-length
20
expires
Mon, 1 Jan 1990 12:00:00 GMT
v1
hb-api.omnitagjs.com/hb-api/prebid/ 		180 B
704 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&CanonicalUrl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&PublisherDomain=https%3A%2F%2Fwww.theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.210.49.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-49-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a7a2326ddee860dc11970003afc7d867a1ac8d76a1a7cf26a7ce87c165703340
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
kong/2.8.4
x-content-type-options
nosniff
x-kong-proxy-latency
0
p3p
CP="CAO PSA OUR"
x-kong-upstream-latency
525
content-length
180
pragma
no-cache
access-control-max-age
3600
access-control-allow-methods
OPTIONS, POST
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
vary
Accept-Encoding
access-control-allow-headers
Accept-Encoding, Content-Type
expires
0
hb
hb.undertone.com/ 		0
521 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.undertone.com/hb?pid=3017&domain=theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-40.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:04 GMT
via
1.1 50cfe0dc07dec77718bfa8346e608936.cloudfront.net (CloudFront)
accept-ch
sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-pop
MUC50-P3
x-cache
Miss from cloudfront
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin
https://www.theepochtimes.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
x-amz-cf-id
qJWfJUxrZEi1T3Cisyv8lFa5ke1HgsvfHMnouWAM0dpx1Y1Lenu_6A==
expires
Mon, 26 Jul 1997 05:00:00 GMT
hb-mm-multi
hb.minutemedia-prebid.com/ 		346 B
695 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.30.181.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-30-181-208.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
c6cbe82680b8930f3096c6ae26c62238d76d7a299f61317cfcf3154b78d47dc3

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
server
istio-envoy
x-reason
auction result is empty
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://www.theepochtimes.com
content-type
application/json
access-control-allow-credentials
true
x-envoy-upstream-service-time
229
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length
346
ads
securepubads.g.doubleclick.net/gampad/ 		30 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4399728119757086&correlator=186009684865942&eid=44807689%2C31079527%2C21065724&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fifs&iu_parts=5965368%2CEET_D_game_top_300x250&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&didk=254739873&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701272584713&lmt=1701257213&adxs=1153&adys=210&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&vis=1&psz=320x0&msz=300x0&fws=4&ohw=1325&ga_vid=468256303.1701272584&ga_sid=1701272585&ga_hid=1446297671&ga_fc=true&dlt=1701272583220&idt=1217&cust_params=EET_user_plan%3D%26site%3Dwww.theepochtimes.com%252Ctheepochtimes.com%26EET_user_type%3Danonymous%26EET_category%3Deet_epochfun-137957%252Ceet_puzzle-games-152300%252Ceet_joypass-free-155614%252Ceet_special-epoch-games-155638%252Ceet_brain-games-156107%252Ceet_featured-special-epoch-games-157768%252Ceet_photo-games-158540%252Ceet_epochfun-premium-166969%252Ceet_frontaudio-161329%26EET_post_tag%3Dgames%252Cpuzzles%26EET_author_name%3DEpoch%2520Puzzles%26EET_post%3D3956489&adks=2135588503&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c37bfbca5f319e098f7b22df968808fc786e28afd4469f12f7b481cf95b67cd5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13169
x-xss-protection
0
google-lineitem-id
6410107570
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138455073008
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
352c44ae8e3132a9bf53d7913c134ad8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame ED5D 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://352c44ae8e3132a9bf53d7913c134ad8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 15:43:04 GMT
expires
Thu, 28 Nov 2024 15:43:04 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		634 B
318 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4399728119757086&correlator=186009684865942&eid=44807689%2C31079527%2C21065724&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fifs&iu_parts=5965368%2CEET_D_game_top_728x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x250%7C970x90%7C728x90&ifi=2&didk=3042669188&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701272584722&lmt=1701257213&adxs=140&adys=210&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&vis=1&psz=975x0&msz=970x0&fws=4&ohw=975&ga_vid=468256303.1701272584&ga_sid=1701272585&ga_hid=1446297671&ga_fc=true&dlt=1701272583220&idt=1217&cust_params=EET_user_plan%3D%26site%3Dwww.theepochtimes.com%252Ctheepochtimes.com%26EET_user_type%3Danonymous%26EET_category%3Deet_epochfun-137957%252Ceet_puzzle-games-152300%252Ceet_joypass-free-155614%252Ceet_special-epoch-games-155638%252Ceet_brain-games-156107%252Ceet_featured-special-epoch-games-157768%252Ceet_photo-games-158540%252Ceet_epochfun-premium-166969%252Ceet_frontaudio-161329%26EET_post_tag%3Dgames%252Cpuzzles%26EET_author_name%3DEpoch%2520Puzzles%26EET_post%3D3956489&adks=1797975165&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
26ff624027ec9de1d042248a164e0ed39b8585fe5611958a48c5e58a2b87fb92
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
286
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
show
subs.theepochtimes.com/template/ Frame 9F48 		8 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/template/show?tid=signin&sid=www.theepochtimes.com&v=6&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=EET%20-%20Responsive%20Signin%20Bar&theme=default
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
d7cd879df53ece5f82d10656b7890db0b9210823870eef37fceef4d7b133dd1c

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 29 Nov 2023 15:43:04 GMT
server
nginx/1.20.1
vary
Accept-Encoding Origin
via
1.1 google
x-robots-tag
noindex
ads
securepubads.g.doubleclick.net/gampad/ 		30 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4399728119757086&correlator=186009684865942&eid=44807689%2C31079527%2C21065724&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fifs&iu_parts=5965368%2CEET_D_game_right_top_300x600&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600%7C300x250&ifi=3&didk=3201861404&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701272584760&lmt=1701257213&adxs=1153&adys=234&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&vis=1&psz=320x0&msz=300x0&fws=4&ohw=1325&ga_vid=468256303.1701272584&ga_sid=1701272585&ga_hid=1446297671&ga_fc=true&dlt=1701272583220&idt=1217&cust_params=EET_user_plan%3D%26site%3Dwww.theepochtimes.com%252Ctheepochtimes.com%26EET_user_type%3Danonymous%26EET_category%3Deet_epochfun-137957%252Ceet_puzzle-games-152300%252Ceet_joypass-free-155614%252Ceet_special-epoch-games-155638%252Ceet_brain-games-156107%252Ceet_featured-special-epoch-games-157768%252Ceet_photo-games-158540%252Ceet_epochfun-premium-166969%252Ceet_frontaudio-161329%26EET_post_tag%3Dgames%252Cpuzzles%26EET_author_name%3DEpoch%2520Puzzles%26EET_post%3D3956489&adks=3838852029&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0b47413ab6869aa6112ffad500e425466563e48bc568c16a20005d8d719c8816
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13138
x-xss-protection
0
google-lineitem-id
6251100676
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138451783838
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 22B9 		91 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/assets/application-uu-f2acbdedb9ab48db13e574a4f5010c5a867cd4ba1f014bae3ad6dcc246e82580.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9341bcd08be331a634026993544cf4d39803cd6b95e8e254250a890a08d2ea81
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://entertainment.service.amuniversal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29990
x-xss-protection
0
server
cafe
etag
934 / 19690 / m202311150101 / config-hash: 2176564774933884501
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Wed, 29 Nov 2023 15:43:04 GMT
addthis_widget.js
s7.addthis.com/js/300/ Frame 22B9 		56 B
360 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/assets/application-uu-f2acbdedb9ab48db13e574a4f5010c5a867cd4ba1f014bae3ad6dcc246e82580.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.45.238.53 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-238-53.deploy.static.akamaitechnologies.com
Software
Oracle API Gateway /
Resource Hash
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://entertainment.service.amuniversal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 29 Nov 2023 15:43:04 GMT
server
Oracle API Gateway
opc-request-id
/EF97F3714610F91BEDF4BC31A9137181/F215E6FAC7CB127B1980242F79B271EA
x-frame-options
sameorigin
vary
Accept-Encoding
content-type
text/javascript
x-distribution
99
x-host
s7.addthis.com
content-length
76
x-xss-protection
1; mode=block
linkid.js
www.google-analytics.com/plugins/ua/ Frame 22B9 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://entertainment.service.amuniversal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 14:52:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
3018
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
697
x-xss-protection
0
last-modified
Fri, 30 Jun 2023 18:58:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Wed, 29 Nov 2023 15:52:46 GMT
identify
mp.theepochtimes.com/identity/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mp.theepochtimes.com/identity/v1/identify
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=900

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-mp-key
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-headers
content-type,x-mp-key
access-control-allow-methods
POST
access-control-allow-origin
*
age
1346
date
Wed, 29 Nov 2023 15:43:04 GMT
server
Kestrel
strict-transport-security
max-age=900
via
1.1 varnish, 1.1 varnish
x-cache
HIT, MISS
x-cache-hits
220, 0
x-fastly-trace-id
1536925614
x-origin-name
4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
x-served-by
cache-mxp6933-MXP, cache-mxp6933-MXP
x-timer
S1701272585.785261,VS0,VE1
identify
mp.theepochtimes.com/identity/v1/ 		174 B
328 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mp.theepochtimes.com/identity/v1/identify
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/9198-90af93414c71cb6d.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Kestrel /
Resource Hash
42e4b57b58c431a4306450e77e5618f29dacc6e7eb8101b703e9e34e7d8bcdfd
Security Headers
Name Value
Strict-Transport-Security max-age=900

Request headers

x-mp-key
us2-c639a6aabfcf124097c91276dd5884fb
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

x-served-by
cache-mxp6933-MXP, cache-mxp6933-MXP
strict-transport-security
max-age=900
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Wed, 29 Nov 2023 15:43:05 GMT
server
Kestrel
x-timer
S1701272585.813163,VS0,VE419
x-origin-name
4PrgpUXX9K0sNAH1JImfyI--F_us2_origin
x-cache
MISS, MISS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
x-fastly-trace-id
1536925773
accept-ranges
bytes
x-cache-hits
0, 0
spotthedifference
securegames.iwin.com/provider/uclick/play/ Frame 980F 		195 B
978 B 		Document
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/provider/uclick/play/spotthedifference?iframe=iframe&clientId=2291&featureId=iwstdd&sda=n&title=n&chat=n&signin=n&data=https%3A%2F%2Fuclick.iwin.com&ref=//www.theepochtimes.com/epoch-games_3940131.html
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/content/iwin-spot-the-difference-daily?client_code=119731P&sub_id=7510&encrypted_url=U2FsdGVkX19KcO2tC7OuKILt3lHpy9ajgWfvILDlZxd9vy%2BhHapSsG1ncnlefgeB%0A9GJAtrVtM8JzVx4RzGzPcTHp6sWqgpw6WY%2F0ehJX9VXwLyaSLtcglijpts5WROmA&embed_type=puzzle&template_type=single
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
3ae32e5c134775466e093528de65d3d225644aaf7f81c1453b5174c95c3318b8

Request headers

Referer
https://entertainment.service.amuniversal.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
Access-Control-Allow-Methods
POST, PUT, DELETE, GET, OPTIONS
Access-Control-Allow-Origin
*
Access-Control-Request-Method
*
Cache-Control
public, max-age=1800
Connection
keep-alive
Content-Encoding
gzip
Content-Length
164
Content-Type
text/html; charset=utf-8
Date
Wed, 29 Nov 2023 15:43:05 GMT
ETag
"653ad63f-c3"
Expires
Tue, 28 Nov 2023 16:57:50 GMT
Last-Modified
Thu, 26 Oct 2023 21:12:31 GMT
Vary
Accept-Encoding
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Id
g52mb4mVAZxWKum-813yU1d1OqOFbU2GqA0RnDfD71VgesQE9yN_wg==
X-Amz-Cf-Pop
MUC50-P4
X-Cache
RefreshHit from cloudfront
X-UA-Compatible
IE=Edge,chrome=1
all.css
use.fontawesome.com/releases/v5.0.12/css/ Frame 25DE 		38 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.0.12/css/all.css
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/css/main.f8b20501.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e2::ac40:8d0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ceee487a90eea3b0e52f01360b44e8b6ac0898062c143dbe724663efd3d6f63

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 22 Sep 2023 01:44:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2371287
etag
W/"d896a88b71aa2ba5d6bd670429bf1bad"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VhKGgIp78YdcG7cbC%2BJdDT7eAGpceeWvk0PrhDHyx4xTvUQYXf%2BeovRNOSRsdQs68Bwzfgb0p9Nyosaom7LFWZ%2Fqvs8KRqKrPFEldQpaHoe6S3lATjx4IkFNKY1zsjHDligikWIbePKotFBalsjIva0j"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31556926
cf-ray
82dbf6d74c48375b-MXP
alt-svc
h3=":443"; ma=86400
raleway-medium-webfont-e80025d59b966e390e81818a115bcf1c8147512973c698731adfee1dbd942572.woff2
entertainment.service.amuniversal.com/assets/ Frame 22B9 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://entertainment.service.amuniversal.com/assets/raleway-medium-webfont-e80025d59b966e390e81818a115bcf1c8147512973c698731adfee1dbd942572.woff2
Requested by
Host: entertainment.service.amuniversal.com
URL: https://entertainment.service.amuniversal.com/assets/application-uu-79b8bc5284ce122857feca100bbb6d6ed8c6b96bb7942a276e418e30a466f74c.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.151 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
e80025d59b966e390e81818a115bcf1c8147512973c698731adfee1dbd942572

Request headers

Referer
https://entertainment.service.amuniversal.com/assets/application-uu-79b8bc5284ce122857feca100bbb6d6ed8c6b96bb7942a276e418e30a466f74c.css
Origin
https://entertainment.service.amuniversal.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:04 GMT
Last-Modified
Mon, 30 Nov 2020 18:20:09 GMT
Connection
Keep-Alive
Accept-Ranges
bytes
ETag
"5ad8-5b5570f6ae840"
Content-Length
23256
Keep-Alive
timeout=5, max=71
userId.bundle.js
subs.theepochtimes.com/lib/ Frame 9F48 		297 KB
100 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/lib/userId.bundle.js
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/template/show?tid=signin&sid=www.theepochtimes.com&v=6&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=EET%20-%20Responsive%20Signin%20Bar&theme=default
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
ead0293d41f0c5fef76a0205ad3060391bdbeec5ae4920c5c6d2edec8bdea2e6

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://subs.theepochtimes.com/template/show?tid=signin&sid=www.theepochtimes.com&v=6&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=EET%20-%20Responsive%20Signin%20Bar&theme=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 03 Nov 2023 19:11:33 GMT
server
nginx/1.20.1
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
max-age=3600, public, no-transform
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 29 Nov 2023 16:43:04 GMT
170.cd359634.chunk.js
comment.youmaker.com/web/v3/static/js/ Frame 25DE 		746 KB
128 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/web/v3/static/js/170.cd359634.chunk.js
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
41a491b6ec4c4ba2be42e5bf9040f0dc254b0fb6db203ad01cdfa10145fdcd21

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 20 Oct 2023 19:30:46 GMT
server
nginx/1.20.1
author
EMG
vary
Accept-Encoding
app-name
remark
content-type
application/javascript
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
app-version
0.1.2
920.163caa5c.chunk.css
comment.youmaker.com/web/v3/static/css/ Frame 25DE 		64 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/web/v3/static/css/920.163caa5c.chunk.css
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
a7cf9d7d46a9d9b0d83d6d91e82f11dd37fbffab2d8841b530f352be0cb6cbd6

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 20 Oct 2023 19:30:46 GMT
server
nginx/1.20.1
author
EMG
vary
Accept-Encoding
app-name
remark
content-type
text/css; charset=utf-8
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
app-version
0.1.2
889.c22e2dd1.chunk.css
comment.youmaker.com/web/v3/static/css/ Frame 25DE 		666 B
360 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/web/v3/static/css/889.c22e2dd1.chunk.css
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
48b782933f4ffe1e923111eb93d3924b4807e78ce63064d0b01e0f96de529a4a

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 20 Oct 2023 19:30:46 GMT
server
nginx/1.20.1
author
EMG
vary
Accept-Encoding
app-name
remark
content-type
text/css; charset=utf-8
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
app-version
0.1.2
889.50003970.chunk.js
comment.youmaker.com/web/v3/static/js/ Frame 25DE 		48 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/web/v3/static/js/889.50003970.chunk.js
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
13b81e5fbcfd1eceeed6736de88e9fce3edf25dead86bb944c0cfe179695128b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 20 Oct 2023 19:30:46 GMT
server
nginx/1.20.1
author
EMG
vary
Accept-Encoding
app-name
remark
content-type
application/javascript
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
app-version
0.1.2
auth
subs.theepochtimes.com/subs/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=1204&subscribed=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://www.theepochtimes.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
via
1.1 google
x-robots-tag
noindex
auth
subs.theepochtimes.com/subs/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=1202&subscribed=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://www.theepochtimes.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
via
1.1 google
x-robots-tag
noindex
auth
subs.theepochtimes.com/subs/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=5201&subscribed=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://www.theepochtimes.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
via
1.1 google
x-robots-tag
noindex
auth
subs.theepochtimes.com/subs/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=8200&subscribed=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://www.theepochtimes.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
via
1.1 google
x-robots-tag
noindex
auth
subs.theepochtimes.com/subs/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=10208&subscribed=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://www.theepochtimes.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
via
1.1 google
x-robots-tag
noindex
auth
subs.theepochtimes.com/subs/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=10204&subscribed=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://www.theepochtimes.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
via
1.1 google
x-robots-tag
noindex
auth
subs.theepochtimes.com/subs/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=10205&subscribed=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://www.theepochtimes.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
via
1.1 google
x-robots-tag
noindex
epoch_mixpanel.min.js
services.epoch.cloud/public-labs/epoch-ai/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://services.epoch.cloud/public-labs/epoch-ai/epoch_mixpanel.min.js?v=2
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f05e45157561299fdf9c77b4ead956006bd678b5e82ad3180d5284e333c3ca28

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 27 Nov 2023 17:57:39 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
790
etag
W/"6564d893-2ffb"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A5fNAdefPXpaOQgz6mSl842Uz6bVK4CCr5Xp36OHQdnFDWitp9t%2BwyCOrl9mmPop5DytdqDmcvr2nxszNpiQL3oPR%2FP1cFpIF1sOG2t8LcXkaTQYwr2viuUis3WmwEndBlIRJTssTwpwYclLWljSh4J9%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400
cf-ray
82dbf6d80d0d83a0-MXP
alt-svc
h3=":443"; ma=86400
optimizer.min.js
services.epoch.cloud/public-labs/ 		34 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://services.epoch.cloud/public-labs/optimizer.min.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9814f85523d0253897e2447a36fdbdc2a5e7647eb96c192f3d278393c955d2f2

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:04 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 22 Nov 2023 16:28:58 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
832
etag
W/"655e2c4a-8651"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=slOsnSMyf2Wz3UwGf5Pp9%2Bx4LNqW0%2FVigUnoriyOFBP0SUP2gKz4FHJxCrUaPWtz7JIHyxtvb8muNwQeWdXzxjBTy7GGWwrTwEvwA4uZ4ucVGZ44N3h%2BSaKlJAUipL7yLP1xEHRknrj0KEo5%2B9iT9yl4ag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400
cf-ray
82dbf6d81d2383a0-MXP
alt-svc
h3=":443"; ma=86400
auth
subs.theepochtimes.com/subs/ 		40 B
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=1204&subscribed=
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
3d7c7f77cc3bb5bf35042f2484343fdccd96a98ee0319542d32a4db82512e8ac

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
40
auth
subs.theepochtimes.com/subs/ 		40 B
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=1202&subscribed=
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
3d7c7f77cc3bb5bf35042f2484343fdccd96a98ee0319542d32a4db82512e8ac

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
40
get
subs.theepochtimes.com/template/ 		60 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/template/get?tid=45ddbb93-dccc-4911-a2da-88d44b296ccc&sid=www.theepochtimes.com&type=noniframe
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
cda3dd8b74a8cb2699277dc3b4d82ac4482304fe884d47bc7638111bb5257bd8

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
server
nginx/1.20.1
vary
Accept-Encoding, Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
auth
subs.theepochtimes.com/subs/ 		40 B
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=5201&subscribed=
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
3d7c7f77cc3bb5bf35042f2484343fdccd96a98ee0319542d32a4db82512e8ac

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
40
auth
subs.theepochtimes.com/subs/ 		40 B
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=8200&subscribed=
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
3d7c7f77cc3bb5bf35042f2484343fdccd96a98ee0319542d32a4db82512e8ac

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
40
auth
subs.theepochtimes.com/subs/ 		41 B
58 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=10208&subscribed=
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
4c834812ad0c6ab8e9cddcf914f1f922d2b52cf81f306bdc361a05641bb0798c

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41
auth
subs.theepochtimes.com/subs/ 		41 B
58 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=10204&subscribed=
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
4c834812ad0c6ab8e9cddcf914f1f922d2b52cf81f306bdc361a05641bb0798c

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41
auth
subs.theepochtimes.com/subs/ 		40 B
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=10205&subscribed=
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
3d7c7f77cc3bb5bf35042f2484343fdccd96a98ee0319542d32a4db82512e8ac

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
40
get
subs.theepochtimes.com/template/ 		40 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/template/get?tid=e4d5c7ed-b909-475c-919f-6721cf03f5d0&sid=www.theepochtimes.com&type=noniframe
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
03268fb285ed8486b6a21e5106f8faa3d517434bbf60c0e9a09e7e2737ce1345

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
server
nginx/1.20.1
vary
Accept-Encoding, Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
user
comment.youmaker.com/api/v1/ Frame 25DE 		57 B
78 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/api/v1/user?site=remark
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
a272a50a6b0526fe9222d72f29741b9d91a156ff75439a43b728fe1d5a6fec0f

Request headers

X-PROVIDER-TOKEN
youmaker
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
accept-language
de-CH,de;q=0.9
X-ACCESS-TOKEN
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-SITE-ID
remark

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
app-name
remark
content-type
application/json; charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57
expires
Thu, 01 Jan 1970 00:00:00 UTC
config
comment.youmaker.com/api/v1/site/ Frame 25DE 		390 B
293 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/api/v1/site/config?site=remark&group=&id=3956489
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
6d819e03aaf3877c15b1d7d532cf06316663cad1aca835ac99497ab08e0bf0e9

Request headers

X-PROVIDER-TOKEN
youmaker
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
accept-language
de-CH,de;q=0.9
X-ACCESS-TOKEN
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-SITE-ID
remark

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
server
nginx/1.20.1
author
EMG
vary
Accept-Encoding
app-name
remark
content-type
application/json; charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private, max-age=0
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 01 Jan 1970 00:00:00 UTC
readonly
comment.youmaker.com/api/v1/ Frame 25DE 		141 B
164 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/api/v1/readonly?site=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&id=3956489&group=
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
b5d46dad614c4aedcb92494a2944c7a343e59efff869fc9ba5ffbbacdb5df0f6

Request headers

X-PROVIDER-TOKEN
youmaker
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
accept-language
de-CH,de;q=0.9
X-ACCESS-TOKEN
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-SITE-ID
remark

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
app-name
remark
content-type
application/json; charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private, max-age=0
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
141
expires
Thu, 01 Jan 1970 00:00:00 UTC
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/ Frame 22B9 		431 KB
135 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b033f59e4ffeaa6f3e4f2e839c035a14811d5469d3f772eda6056d7d5782c53f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://entertainment.service.amuniversal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:17:58 GMT
content-encoding
br
x-content-type-options
nosniff
age
1507
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
138149
x-xss-protection
0
server
cafe
etag
11558412289700915514
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Thu, 28 Nov 2024 15:17:58 GMT
lib.min.js
mixproxy.epoch.cloud/mixpanel/ 		52 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mixproxy.epoch.cloud/mixpanel/lib.min.js
Requested by
Host: services.epoch.cloud
URL: https://services.epoch.cloud/public-labs/epoch-ai/epoch_mixpanel.min.js?v=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
acb1221313fbb4d27f785ffd7a9ade0f7f44c37567ce1abf6aff7c399a7992d4

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
br
cf-cache-status
REVALIDATED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid
ABPtcPquqP5ZRbzYw3_N7qL6q9Bs6Vl1C63cl1TbMPJqh29_-LHpAVfa0NcmbopHsaBfmPzvLBWj5EjMFRYaNC_Omr3xHg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 14 Nov 2023 19:54:10 GMT
server
cloudflare
etag
W/"dff66d0b72bdc18a02be56412d5ef8c4"
vary
Accept-Encoding
x-goog-hash
crc32c=VW26dg==, md5=3/ZtC3K9wYoCvlZBLV74xA==
x-goog-generation
1699991650202934
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=14400
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X1TyZRqLvA1JvJ9fgoOX86fBbmGqvnr1Vn9SKB79KP0QGI8I2MRuYJwb5GA1slPvHgqGOt7UPHlNVKVNbrqkvId%2Fq5lmhP5fwDb38vdM0AMhjp06eJ7t4s0sOtfoCc41Fp3qQobxHoGsRpIOYBiZUN3drQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length
18139
cf-ray
82dbf6d89da683a0-MXP
expires
Wed, 29 Nov 2023 15:53:05 GMT
et_so_utils.js
services.epoch.cloud/public-labs/epoch-ai/smarto/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://services.epoch.cloud/public-labs/epoch-ai/smarto/et_so_utils.js?v=2023-11-29T15
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
946c9c95fb7da4ae9249907e40e11291c00135e70991d34811f08617b20a5b67

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 23 Oct 2023 16:24:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
790
etag
W/"65369e4c-3506"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CRPipbnZlDmXAri2wL1PwxKrPkYQgSMIM1ZjOJ9X633j80XRGUcAxqnhq0nfJNIM49sYjxzlc%2FOnHQyEw2YJnPo6q3xyeKjceNKkpxt9%2FErslU3OvONZkTsy51KCSu3QXdjtZ4n%2B86zY3pieAMO1k0v9xQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400
cf-ray
82dbf6d92ab30e2b-MXP
alt-svc
h3=":443"; ma=86400
/
securegames.iwin.com/m/console/v_313/ Frame 980F 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/console/v_313/
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/provider/uclick/play/spotthedifference?iframe=iframe&clientId=2291&featureId=iwstdd&sda=n&title=n&chat=n&signin=n&data=https%3A%2F%2Fuclick.iwin.com&ref=//www.theepochtimes.com/epoch-games_3940131.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
9085790bc286fc03e43b1a9ad10128e7b8202fe0332d4c93ff67338f84089056

Request headers

Referer
https://securegames.iwin.com/provider/uclick/play/spotthedifference?iframe=iframe&clientId=2291&featureId=iwstdd&sda=n&title=n&chat=n&signin=n&data=https%3A%2F%2Fuclick.iwin.com&ref=//www.theepochtimes.com/epoch-games_3940131.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Accept-Ranges
bytes
Age
4933560
Cache-Control
public, max-age=31536000
Connection
keep-alive
Content-Encoding
gzip
Content-Length
1047
Content-Type
text/html
Date
Tue, 03 Oct 2023 13:17:05 GMT
ETag
"3616544848+gzip"
Expires
Wed, 02 Oct 2024 13:17:05 GMT
Last-Modified
Thu, 08 Dec 2022 10:50:06 GMT
Vary
Accept-Encoding
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Id
ocJ7y7B4WkCGTM7ZRcsTjAJT4HapBW2ZvqajztTVy6bx4FHWNftabw==
X-Amz-Cf-Pop
MUC50-P4
X-Cache
Hit from cloudfront
main.less.css
securegames.iwin.com/m/console/v_313/site-console/css/app/ Frame 980F 		102 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/console/v_313/site-console/css/app/main.less.css
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
600a7f178e74cf227051f057b1b54c0277341f6a71914c09b766126ef0d5f90c

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/console/v_313/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 01 Nov 2023 04:09:37 GMT
Content-Encoding
gzip
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
2460808
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
16563
Last-Modified
Thu, 08 Dec 2022 10:50:06 GMT
ETag
"2625741660+gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
HhAja_TlKr0SvEcOGxS4qZujgmaM6-zfGMoSjlxRuiuLVEnc-1EhlQ==
Expires
Thu, 31 Oct 2024 04:09:37 GMT
require.js
securegames.iwin.com/m/console/v_313/site-console/js/ Frame 980F 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/console/v_313/site-console/js/require.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
912cc294d0de9f7e737ecbd968834e11027f59047a3073c060c0112513d773f2

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/console/v_313/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 22:12:30 GMT
Content-Encoding
gzip
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
14059835
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
6298
Last-Modified
Thu, 08 Dec 2022 10:50:06 GMT
ETag
"622260545+gzip"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
jeSmxCs0X5OT02wARY7Z-l6EBkmoRlHrBYTq2YAX2w5WrmluF0RcuA==
Expires
Tue, 18 Jun 2024 22:12:30 GMT
counts
comment.youmaker.com/api/v1/ Frame 25DE 		111 B
137 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/api/v1/counts?site=remark&post=id
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
d632c0bc914a2ed628780c4d21837a13ab8dce193e303b7cd6385f17437a7e49

Request headers

X-PROVIDER-TOKEN
youmaker
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
accept-language
de-CH,de;q=0.9
X-ACCESS-TOKEN
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-SITE-ID
remark
Content-Type
application/json

Response headers

expires
Thu, 01 Jan 1970 00:00:00 UTC
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111
pragma
no-cache
server
nginx/1.20.1
author
EMG
app-name
remark
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://comment.youmaker.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials
true
x-robots-tag
noindex
app-version
0.1.2
20
comment.youmaker.com/api/v1/getlist/ Frame 25DE 		21 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/api/v1/getlist/20?site=remark&group=&offset=0&sort=-time&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&id=3956489
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
04f2329e7bc5aff19476780214be18ee34214d7a1f8bd4380761e712fadd994c

Request headers

X-PROVIDER-TOKEN
youmaker
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
accept-language
de-CH,de;q=0.9
X-ACCESS-TOKEN
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-SITE-ID
remark

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
server
nginx/1.20.1
author
EMG
vary
Accept-Encoding
app-name
remark
content-type
application/json; charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private, max-age=0
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 01 Jan 1970 00:00:00 UTC
truncated
/ Frame 25DE 		3 KB
3 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7bf4473ecc25fc8a56c7da4846022537d11e73a499922e0a16be9b8f83869052

Request headers

Referer
Origin
https://comment.youmaker.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff;charset=utf-8
Acta-Book.otf
img.theepochtimes.com/fonts/ Frame 25DE 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://img.theepochtimes.com/fonts/Acta-Book.otf
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/css/main.f8b20501.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.19.198.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-198-122.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash

Request headers

Referer
https://comment.youmaker.com/
Origin
https://comment.youmaker.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:05 GMT
Server
nginx
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
text/html
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC
Access-Control-Allow-Credentials
true
Connection
keep-alive
Akamai-Mon-Iucid-Del
1289467
Access-Control-Allow-Headers
origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session
Content-Length
548
RingsideNarrow-Book.otf
img.theepochtimes.com/fonts/ Frame 25DE 		124 KB
125 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://img.theepochtimes.com/fonts/RingsideNarrow-Book.otf
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/css/main.f8b20501.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.19.198.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-198-122.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d1a4a7aa00e62b62538f84f4f380c16796c88078656d204c4f5ceebb59d84fe8

Request headers

Referer
https://comment.youmaker.com/
Origin
https://comment.youmaker.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:05 GMT
Connection
keep-alive
Akamai-Mon-Iucid-Del
1289467
Content-Length
126860
Last-Modified
Tue, 11 Jul 2023 21:21:51 GMT
Server
nginx
ETag
"64adc7ef-1ef8c"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC
Cache-Control
max-age=27912896
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session
RingsideNarrow-Medium.otf
img.theepochtimes.com/fonts/ Frame 25DE 		123 KB
124 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://img.theepochtimes.com/fonts/RingsideNarrow-Medium.otf
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/css/main.f8b20501.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.19.198.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-198-122.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
02e05d8407482aee2dae0ae4343ecb2e6c2b1f27c2175c4b03170d3f2af51b55

Request headers

Referer
https://comment.youmaker.com/
Origin
https://comment.youmaker.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:05 GMT
Connection
keep-alive
Akamai-Mon-Iucid-Del
1289467
Content-Length
126244
Last-Modified
Tue, 27 Jun 2023 23:57:44 GMT
Server
nginx
ETag
"649b7778-1ed24"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC
Cache-Control
max-age=27299712
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session
grumi.js
rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/ Frame 5433 		220 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.26.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-26-75.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6486dc0dd88f16d057de0089d5d280dd337fe701d214fe983e8a5296b547ef23

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:21:39 GMT
x-amz-version-id
q7zqv.uEOfOJikhhuTCVfETBlbbOohyX
content-encoding
br
last-modified
Wed, 29 Nov 2023 15:20:04 GMT
server
AmazonS3
via
1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P7
etag
W/"c110f54d29d688f94293c6e6e7a34a5b"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
age
1287
x-amz-cf-id
xzJWYQmfwGBvcZrZN8nzBpEzMUcaBSNNJs6nj26KcfBaIs7CLHaOxQ==
RingsideNarrow-Semibold.otf
cdn.epoch.cloud/assets/fonts/ Frame 9F48 		123 KB
124 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.epoch.cloud/assets/fonts/RingsideNarrow-Semibold.otf
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfabd954a3ec494e41f63bab6f12a56ce35150c3b6eb0da47f1e61d5c22bfc2a

Request headers

Referer
https://subs.theepochtimes.com/
Origin
https://subs.theepochtimes.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
cf-cache-status
EXPIRED
last-modified
Fri, 26 Jun 2020 15:18:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"5ef611c9-1ede8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5P9pYQPdpu3PUDWa%2BQdS6yuSs6OKzOWwPNX6fsoKliMzTe1d6Wx3CvtsT3ZLrSskEWCXD%2FHe2vF%2Bww2sJuWepijsredDXmCi2Svr9jc9cYg1k1Am3plFXUXh5aWwXHOWLX8IqmipUQeW6X6QUIw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
82dbf6da5bf6374c-MXP
alt-svc
h3=":443"; ma=86400
content-length
126440
/
sdk.iad-05.braze.com/api/v3/data/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://sdk.iad-05.braze.com/api/v3/data/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-braze-api-key,x-braze-datarequest,x-braze-last-req-ms-ago,x-braze-req-attempt,x-braze-triggersrequest,x-requested-with
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-headers
content-type,x-braze-api-key,x-braze-datarequest,x-braze-last-req-ms-ago,x-braze-req-attempt,x-braze-triggersrequest,x-requested-with
access-control-allow-methods
POST, GET
access-control-allow-origin
*
access-control-expose-headers
access-control-max-age
7200
content-encoding
gzip
date
Wed, 29 Nov 2023 15:43:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 varnish
x-cache
MISS
x-cache-hits
0
x-served-by
cache-mxp6951-MXP
/
sdk.iad-05.braze.com/api/v3/data/ 		261 B
407 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sdk.iad-05.braze.com/api/v3/data/
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/9489.d680c7df41a5be6f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
282c2e3d26968b51b2150825454e32ad5d03e7fd849567c951fdfeb4fa44a170
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

X-Braze-Api-Key
63facf2c-fb11-4a1e-bdfc-4439a2cb1142
X-Braze-TriggersRequest
true
X-Braze-DataRequest
true
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/json
X-Braze-Last-Req-Ms-Ago
7200000
Referer
https://www.theepochtimes.com/
X-Requested-With
XMLHttpRequest
X-Braze-Req-Attempt
1

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 varnish
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
MISS
x-request-id
c3f95d5f-e698-4a2d-93b9-74c3a6a9c735
x-served-by
cache-mxp6951-MXP
x-runtime
0.194510
etag
W/"282c2e3d26968b51b2150825454e32ad"
access-control-max-age
7200
access-control-allow-methods
POST, GET
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
vary
Origin,Accept-Encoding
accept-ranges
bytes
x-cache-hits
0
get
subs.theepochtimes.com/template/ 		199 B
217 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/template/get?tid=9b52e988-2c2d-4f6a-9c92-69faaf11c36a&sid=www.theepochtimes.com&version=22
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
c99085b7fb1f2a887546ef03893582856b0ca792472ad92629a75177e66a803e

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
199
get
subs.theepochtimes.com/template/ 		205 B
223 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/template/get?tid=924e14b9-3ed2-41d0-ae93-07246a558b57&sid=www.theepochtimes.com
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
fbd96f97dfabbb444dd155929e9632f5049251e4a8885989179fffb74ea6348a

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
205
auth
subs.theepochtimes.com/subs/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=10214&subscribed=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://www.theepochtimes.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
via
1.1 google
x-robots-tag
noindex
auth
subs.theepochtimes.com/subs/ 		40 B
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/subs/auth?siteid=www.theepochtimes.com&planid=4c14e06e-dead-4a19-833b-f676ae9d77da&nid=10214&subscribed=
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
3d7c7f77cc3bb5bf35042f2484343fdccd96a98ee0319542d32a4db82512e8ac

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-credentials
true
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
40
view
securepubads.g.doubleclick.net/pcs/ Frame 5433 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssmtQ9-BfsM0PsYvfDmnd5tJahvVbxx5VNFa4djmz0t71-Qi9HGCJxKt0ohECJ-ebCZe-306Rh6_4PrFO139qJqD559JRdEGTDsbq0EruuCbJY_DkTu7YJEuqHhJ7tZYIrWnuKMvuF4m0pyZ802zvpkDXKkXGHcJUxuMHjyeBdLzpMoctjw9L7qU35pTDGoVYoeV3-EZCc1RrSFRxqtPnNk-MwM2ngm62DARtHKbsnNSQdeuK3Pqwmn1wJbfzKsSq6ryK1ErvGzlveZa8p-Yk2CFBIHsL8aOye0l-lCIjnmVNRiEdcifEf3n7Ba9ksuHR2UacrLrEaxflh1S8c6fvpCCrgcoH07RQK5q5Sgo6LLx6CxRh4LA9YzQhs7ab7iqPxDP0JpmLY2aJgQ&sai=AMfl-YSqR0hgXwBkktpYv9m1JVZq_RVD2V92L0sLvAlOVJR3xY5Q-3m06ollllOJG8TN84oV0EZB6LKAK1YkRXy4iwPGuWtyWpr_yjGqk_UBjUY2TlNUua49QIAc8tI7_k1HJS9pvX_6hAYm&sig=Cg0ArKJSzMlv4UcIE-7nEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame 5433 		202 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65070
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1700193896630564"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 29 Nov 2023 15:43:05 GMT
12785890718775198897
tpc.googlesyndication.com/simgad/ Frame 5433 		244 KB
244 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/12785890718775198897?
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c6efe5797cf0826affa1dad9e68852f73624d3360188765cc5eedd356f348f03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 05:24:22 GMT
x-content-type-options
nosniff
age
209923
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
249539
x-xss-protection
0
last-modified
Wed, 22 Nov 2023 00:04:57 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Tue, 26 Nov 2024 05:24:22 GMT
main.js
securegames.iwin.com/m/console/v_313/site-console/js/ Frame 980F 		523 KB
137 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/require.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
f065c87ccbdaf40a969620650e1e3f479ebb00369c87e714a454c6ea66b9a46d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/console/v_313/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 16:47:19 GMT
Content-Encoding
gzip
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
8031346
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
139877
Last-Modified
Mon, 28 Aug 2023 15:45:09 GMT
ETag
"1751776033+gzip"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
dQFd4p7I5NjHblpLjKmXBKjHgaCQJWeZ0ooYSaxQp29KbltiJqvfEg==
Expires
Tue, 27 Aug 2024 16:47:19 GMT
/
mixproxy.epoch.cloud/mixpanel/track/ 		1 B
585 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mixproxy.epoch.cloud/mixpanel/track/?ip=1&_=1701272585354
Requested by
Host: mixproxy.epoch.cloud
URL: https://mixproxy.epoch.cloud/mixpanel/lib.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=604800; includeSubDomains

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
strict-transport-security
max-age=604800; includeSubDomains
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time
17
alt-svc
h3=":443"; ma=86400
content-length
1
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.theepochtimes.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jShESfdKwKl8NYTtv0%2BjwjoyZu872OYHNgsIsnAsIeTbFeHnDWMMJZYCd0eK5C0lmGUHWO2ECyC1qYwt6WuUFdag5iEMH%2FJmf1HdMJKIrwiPOlMpmFvVvmTeb8VaHSs%2F4qDvJtegwvR5RPwWExBA1xcAbg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
X-MP-CE-Backoff
cache-control
no-cache, no-store
access-control-allow-credentials
true
cf-ray
82dbf6da7cdb0e2b-MXP
access-control-allow-headers
X-Requested-With
truncated
/ Frame 5433 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0c94797789d1ff77c0220cee8229aa616a330c2bc221d533a24a53bfc421fc3f

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
init
gw.geoedge.be/api/ 		0
217 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gw.geoedge.be/api/init
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.93.134 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-93-134.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 14930ca61b5acb472c19a8d7b170ad10.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
M0T0O_AZEBjBEhPv2BTKVUbRhJEF9AKAIZHuDi3ReexvvNksw6Mryw==
x-cache
Miss from cloudfront
report
gw.geoedge.be/api/ 		0
215 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gw.geoedge.be/api/report
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.93.134 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-93-134.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 14930ca61b5acb472c19a8d7b170ad10.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
e2DrHZmA8_bY5-wxQoz3f-39-LYAKYhvioM5JjSHxeoUqGYBHpi-ww==
x-cache
Miss from cloudfront
show
subs.theepochtimes.com/template/ Frame F4C1 		13 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/template/show?tid=9b52e988-2c2d-4f6a-9c92-69faaf11c36a&sid=www.theepochtimes.com&v=22&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=Organic%20RW&rs=1&variantName=Games-0821-desktop&primary_category=epochfun-137957%3Bpuzzle-games-152300%3Bjoypass-free-155614%3Bspecial-epoch-games-155638%3Bbrain-games-156107%3Bfeatured-special-epoch-games-157768%3Bphoto-games-158540%3Bepochfun-premium-166969%3Bfrontaudio-161329
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
1fbf42cca7f7ae74c38072d0079ef895e071dae27c920814f8c58446b8d3a8e1

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 29 Nov 2023 15:43:05 GMT
server
nginx/1.20.1
vary
Accept-Encoding Origin
via
1.1 google
x-robots-tag
noindex
reply
comment.youmaker.com/api/v1/counts/ Frame 25DE 		1 KB
650 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://comment.youmaker.com/api/v1/counts/reply?site=remark&group=&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&id=3956489&post=gids
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/js/main.7036b77e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
fc23d4c58c5416bea5f8e58c97252284f0e5948b19f35121792868b0eda29d82

Request headers

X-PROVIDER-TOKEN
youmaker
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
accept-language
de-CH,de;q=0.9
X-ACCESS-TOKEN
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-SITE-ID
remark
Content-Type
application/json

Response headers

expires
Thu, 01 Jan 1970 00:00:00 UTC
date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
pragma
no-cache
server
nginx/1.20.1
author
EMG
vary
Accept-Encoding, Origin
app-name
remark
content-type
application/json; charset=utf-8
access-control-allow-origin
https://comment.youmaker.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials
true
x-robots-tag
noindex
app-version
0.1.2
home.html
securegames.iwin.com/m/console/v_313/site-console/views/ Frame 980F 		15 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/console/v_313/site-console/views/home.html
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
10fd19987fe77295a94dc1705bba56980c2c4ba3859e76b3f7248a476ad4b6a5

Request headers

Accept
application/json, text/plain, */*
Referer
https://securegames.iwin.com/m/console/v_313/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 08 Sep 2023 17:14:36 GMT
Content-Encoding
gzip
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
7079309
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
6121
Last-Modified
Thu, 08 Dec 2022 10:50:06 GMT
ETag
"3608038882+gzip"
Vary
Accept-Encoding
Content-Type
text/html
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
zNjLywru0C1FY1m8jhEiIjntt07BP_g3_Bo4pReN3SQx2SfaFtDvDQ==
Expires
Sat, 07 Sep 2024 17:14:36 GMT
sprites.png
securegames.iwin.com/m/console/v_313/site-console/css/app/ Frame 980F 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securegames.iwin.com/m/console/v_313/site-console/css/app/sprites.png
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/css/app/main.less.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
68d58fedffba037ce6ccb99e29a9944b1a60f44630b95f0bcc41ea41eb2e7322

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/console/v_313/site-console/css/app/main.less.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 07:07:18 GMT
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
Last-Modified
Thu, 08 Dec 2022 10:50:06 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6078946
ETag
"4164586214"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
44622
X-Amz-Cf-Id
9ksLCyktS2xR39hXQYrLezsvtPK6q7ZIHVtuDGatKfXESUFLgHlXBQ==
Expires
Thu, 19 Sep 2024 07:07:18 GMT
progress.gif
securegames.iwin.com/m/console/v_313/site-console/img/ Frame 980F 		769 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securegames.iwin.com/m/console/v_313/site-console/img/progress.gif
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/css/app/main.less.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
e6f3afe265986e684ce3c5a19901e43753328ced4ff16dc360d3768be03cff2c

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/console/v_313/site-console/css/app/main.less.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 30 Sep 2023 00:21:21 GMT
Via
1.1 3d60650fd0c339e18e816ce29f9a0da0.cloudfront.net (CloudFront)
Last-Modified
Thu, 08 Dec 2022 10:50:06 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
5239304
ETag
"738900541"
X-Cache
Hit from cloudfront
Content-Type
image/gif
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
769
X-Amz-Cf-Id
dmKPWxC8Z9Mjl1UlAzrYb_KkrvvXLSmMbNZeA7jEfG1UgPK1Zp4ERA==
Expires
Sun, 29 Sep 2024 00:21:21 GMT
truncated
/ Frame 980F 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c0ae202bdbb35b4c08d044b9a3f5e799dd17ef00ac057c8a46764cd731246779

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
game_details.json
securegames.iwin.com/m/uclick/spotthedifference/v_8/ Frame 980F 		207 B
743 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/game_details.json
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
7bb5d448d600765bd6780d8857ed56c4c17df18c54b537976e7435a8ae70131e

Request headers

Accept
application/json, text/plain, */*
Referer
https://securegames.iwin.com/m/console/v_313/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 14:59:41 GMT
Via
1.1 3d60650fd0c339e18e816ce29f9a0da0.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:06 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
2604
ETag
"3652007173"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
207
X-Amz-Cf-Id
f5oyMXi9dKoujG0HzasIcIPfiXWe-BZ-I3Z13HOcsXS1GAd-O0wPxA==
Expires
Wed, 29 Nov 2023 18:59:41 GMT
online-games
m.iwin.com/ Frame 980F
Redirect Chain
  • https://securegames.iwin.com/data/gtm.json
  • https://m.iwin.com/online-games
104 KB
15 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://m.iwin.com/online-games
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Server
44.219.140.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-219-140-141.compute-1.amazonaws.com
Software
/
Resource Hash
3188746e7bc3a92549608bd58ca7324a1acf1a957737f5c6bdd35b645ce823f9
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
access-control-request-method
*
age
6954
content-length
15049
x-ua-compatible
IE=Edge,chrome=1
last-modified
Thu, 26 Oct 2023 21:12:31 GMT
etag
"653ad63f-19e38"
x-frame-options
SAMEORIGIN
access-control-allow-methods
POST, PUT, DELETE, GET, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=1800
vary
Origin,Accept-Encoding
accept-ranges
bytes
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
expires
Wed, 29 Nov 2023 14:17:11 GMT

Redirect headers

Date
Wed, 29 Nov 2023 00:19:27 GMT
Access-Control-Request-Method
*
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
55418
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
184
X-UA-Compatible
IE=Edge,chrome=1
X-FRAME-OPTIONS
SAMEORIGIN
Access-Control-Allow-Methods
POST, PUT, DELETE, GET, OPTIONS
Content-Type
text/html; charset=utf-8
Location
https://m.iwin.com/online-games
Access-Control-Allow-Origin
*
Vary
Accept-Encoding
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
X-Amz-Cf-Id
09tcnZgJW1NJ4FSlHtWKCST34WNRGK5YStEh78bx0CWnXJflRCoyUw==
userId.bundle.js
subs.theepochtimes.com/lib/ Frame F4C1 		297 KB
100 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://subs.theepochtimes.com/lib/userId.bundle.js
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/template/show?tid=9b52e988-2c2d-4f6a-9c92-69faaf11c36a&sid=www.theepochtimes.com&v=22&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=Organic%20RW&rs=1&variantName=Games-0821-desktop&primary_category=epochfun-137957%3Bpuzzle-games-152300%3Bjoypass-free-155614%3Bspecial-epoch-games-155638%3Bbrain-games-156107%3Bfeatured-special-epoch-games-157768%3Bphoto-games-158540%3Bepochfun-premium-166969%3Bfrontaudio-161329
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.102.198.207 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
207.198.102.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
ead0293d41f0c5fef76a0205ad3060391bdbeec5ae4920c5c6d2edec8bdea2e6

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://subs.theepochtimes.com/template/show?tid=9b52e988-2c2d-4f6a-9c92-69faaf11c36a&sid=www.theepochtimes.com&v=22&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=Organic%20RW&rs=1&variantName=Games-0821-desktop&primary_category=epochfun-137957%3Bpuzzle-games-152300%3Bjoypass-free-155614%3Bspecial-epoch-games-155638%3Bbrain-games-156107%3Bfeatured-special-epoch-games-157768%3Bphoto-games-158540%3Bepochfun-premium-166969%3Bfrontaudio-161329
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 03 Nov 2023 19:11:33 GMT
server
nginx/1.20.1
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
max-age=3600, public, no-transform
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 29 Nov 2023 16:43:05 GMT
react.production.min.js
pwe.epochbase.com/libs/react@17.0.2/ Frame F4C1 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pwe.epochbase.com/libs/react@17.0.2/react.production.min.js
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/template/show?tid=9b52e988-2c2d-4f6a-9c92-69faaf11c36a&sid=www.theepochtimes.com&v=22&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=Organic%20RW&rs=1&variantName=Games-0821-desktop&primary_category=epochfun-137957%3Bpuzzle-games-152300%3Bjoypass-free-155614%3Bspecial-epoch-games-155638%3Bbrain-games-156107%3Bfeatured-special-epoch-games-157768%3Bphoto-games-158540%3Bepochfun-premium-166969%3Bfrontaudio-161329
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.110.129.224 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
224.129.110.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
229bbf4d0e7488209564152c6723497f1ac3934136ca1684233d2fa88fa4146f

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://subs.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 28 Oct 2022 15:38:34 GMT
server
nginx/1.20.1
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
react-dom.production.min.js
pwe.epochbase.com/libs/react@17.0.2/ Frame F4C1 		118 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pwe.epochbase.com/libs/react@17.0.2/react-dom.production.min.js
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/template/show?tid=9b52e988-2c2d-4f6a-9c92-69faaf11c36a&sid=www.theepochtimes.com&v=22&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=Organic%20RW&rs=1&variantName=Games-0821-desktop&primary_category=epochfun-137957%3Bpuzzle-games-152300%3Bjoypass-free-155614%3Bspecial-epoch-games-155638%3Bbrain-games-156107%3Bfeatured-special-epoch-games-157768%3Bphoto-games-158540%3Bepochfun-premium-166969%3Bfrontaudio-161329
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.110.129.224 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
224.129.110.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
9db33292007ab6c38527b39d5663e976a305564e19b2a5a8713ea2b2c00f505d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://subs.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 28 Oct 2022 15:41:06 GMT
server
nginx/1.20.1
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
jquery.cookie.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/ Frame F4C1 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/template/show?tid=9b52e988-2c2d-4f6a-9c92-69faaf11c36a&sid=www.theepochtimes.com&v=22&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=Organic%20RW&rs=1&variantName=Games-0821-desktop&primary_category=epochfun-137957%3Bpuzzle-games-152300%3Bjoypass-free-155614%3Bspecial-epoch-games-155638%3Bbrain-games-156107%3Bfeatured-special-epoch-games-157768%3Bphoto-games-158540%3Bepochfun-premium-166969%3Bfrontaudio-161329
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://subs.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1625403
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
591
last-modified
Mon, 04 May 2020 16:11:45 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec1-514"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QxPrX7TLiIhnizhdicQw7Psg%2FrnuG8QPgsU2nITRsZO%2FuzARMIbGDxK%2FCOXMLavsMYLNBG2WibliHr6WFG%2BbQCXVkiP96q3nYFGKRV4t7Yj8bKNXrJecgDXEB73nbDFsUFmxVt3aPZ4sh%2FWFdW1L7zUY"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
82dbf6dc6c05f138-CDG
expires
Mon, 18 Nov 2024 15:43:05 GMT
et_utils.js
services.epoch.cloud/public-labs/epoch-ai/ Frame F4C1 		151 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://services.epoch.cloud/public-labs/epoch-ai/et_utils.js
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/template/show?tid=9b52e988-2c2d-4f6a-9c92-69faaf11c36a&sid=www.theepochtimes.com&v=22&ck=JTdCJTIyZXBvY2hfdXNlcl9pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Nlc3Npb25pZCUyMiUzQSUyMiUyMiUyQyUyMmVwb2NoX3Rva2VuJTIyJTNBJTIyJTIyJTJDJTIyZXBvY2hfc3Vic2NyaWJlZCUyMiUzQSUyMiUyMiU3RA==&pl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&u=JTdCJTIyaW5mbyUyMiUzQSU3QiUyMmNsaWVudElkJTIyJTNBJTIyZGNiOGIxOTItMjMyNy00YjU2LTk1OGYtZGUwYzlmN2E4MTM0JTIyJTJDJTIyaWQlMjIlM0ElMjIlMjIlMkMlMjJuZXdJZCUyMiUzQTAlMkMlMjJlbWFpbCUyMiUzQSUyMiUyMiUyQyUyMnBpY3R1cmUlMjIlM0ElMjIlMjIlMkMlMjJuYW1lJTIyJTNBJTIyJTIyJTJDJTIyZmlyc3ROYW1lJTIyJTNBJTIyJTIyJTJDJTIybGFzdE5hbWUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpc3RlckRhdGUlMjIlM0EwJTJDJTIyaXNFbWFpbFZlcmlmaWVkJTIyJTNBZmFsc2UlN0QlMkMlMjJnZW8lMjIlM0ElN0IlMjJjb3VudHJ5JTIyJTNBJTIyQ0glMjIlMkMlMjJjaXR5JTIyJTNBJTIyJTIyJTJDJTIydGltZXpvbmUlMjIlM0ElMjJFdXJvcGUlMkZadXJpY2glMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ3LjE0NDklMkMlMjJsb25naXR1ZGUlMjIlM0E4LjE1NTElN0QlMkMlMjJzdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyaGlzdG9yaWNTdWJzY3JpcHRpb25zJTIyJTNBJTVCJTVEJTJDJTIyc3Vic2NyaXB0aW9uJTIyJTNBJTdCJTIyc3Vic2NyaWJlZCUyMiUzQWZhbHNlJTJDJTIycmVnaW9uSWQlMjIlM0ElMjIlMjIlMkMlMjJzdWJzY3JpcHRpb25UeXBlJTIyJTNBJTIyJTIyJTJDJTIycGxhbklkJTIyJTNBJTIyJTIyJTJDJTIyZXhwaXJhdGlvbiUyMiUzQTAlN0QlN0Q=&tn=Organic%20RW&rs=1&variantName=Games-0821-desktop&primary_category=epochfun-137957%3Bpuzzle-games-152300%3Bjoypass-free-155614%3Bspecial-epoch-games-155638%3Bbrain-games-156107%3Bfeatured-special-epoch-games-157768%3Bphoto-games-158540%3Bepochfun-premium-166969%3Bfrontaudio-161329
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b75f430e209cb052e257a4461f31bc7723cf5115d5c1b4b49cfa147bf8fbb29b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://subs.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 29 Nov 2023 15:27:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
395
etag
W/"6567585c-25cba"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VsywN3hOH9MFJVaLjUolykaIwPzk6M4LgGAGCKHu22DjMdq%2FZ6uErBGpee8srDSZgMeFkIZPYbhdJWw9fS%2FU08whPerC9IPg%2BdqsTTS8sK9xquniyPUhhzZaaDN8N5gFsAhR9N5oDdz02Q41z5GOInuzJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400
cf-ray
82dbf6dbff3c0e2b-MXP
alt-svc
h3=":443"; ma=86400
8bcc5ba1b51be8db315598d399d2060ff89e0bf9.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/8bcc5ba1b51be8db315598d399d2060ff89e0bf9.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
29efd3d4a21ddff23a1be68a3cba1da4d81ca344.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/29efd3d4a21ddff23a1be68a3cba1da4d81ca344.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
3bef4c5d840da1f41734a11022e539cb131310b7.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/3bef4c5d840da1f41734a11022e539cb131310b7.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
14331061949611ec3534c70ddbbfe30498a3faf7.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/14331061949611ec3534c70ddbbfe30498a3faf7.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
79b3de89737acc215886576ac7420e1b44d97df0.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/79b3de89737acc215886576ac7420e1b44d97df0.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
67ea9685826ffd7e8a196d1b46462391635a1749.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/67ea9685826ffd7e8a196d1b46462391635a1749.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
cfe5b53c79667fb4078370ce6d60455abfa73ea9.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/cfe5b53c79667fb4078370ce6d60455abfa73ea9.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
28ef7bfdfa810fd7bf21438b54bb42253bea8614.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/28ef7bfdfa810fd7bf21438b54bb42253bea8614.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
f705248886428118839413cde1637a51408f67f2.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/f705248886428118839413cde1637a51408f67f2.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
7d9c371cec99ac8fa437302c6d301d8a094379ea.image
comment.youmaker.com/api/v1/avatar/ Frame 25DE 		0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://comment.youmaker.com/api/v1/avatar/7d9c371cec99ac8fa437302c6d301d8a094379ea.image?site=remark
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.120.33.89 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
89.33.120.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://comment.youmaker.com/web/v3/?host=https://comment.youmaker.com&theme=epochfun&site_id=remark&url=theepochtimes.com/epochfun/spot-the-difference-daily-3956489&url_id=3956489&group=&provider=youmaker&token=&page_title=Spot%20the%20Difference%20Daily
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

app-version
0.1.2
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
via
1.1 google
server
nginx/1.20.1
author
EMG
etag
""
app-name
remark
cache-control
max-age=604800
x-robots-tag
noindex
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
view
securepubads.g.doubleclick.net/pcs/ Frame 5433 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsscoV8gFdpq6pDP0IGzG8mRa4efcLqOVY_CHSxa0X_FMmbF1urw5X_IY-lSRAOWPtGjyn1TI7VTpEiFTTvgB65QX1h50XcoUVPEIh9LOuzjgHUZfqRcg0JPxkkDsncFnhuaMZ2UMgzBTbtXnPIL3tdSSUxVytCdqKFwbKclSegPfIRtypkcWUPb8s91aU5nH0MZtnf-PeiYX2BsRv-DxfHhVr5PlGUHAKLdM_oLhBi9R5rdx79MwSedAuS3hrt8wXdRHvUPCVZBQk1k7UCJ9uw7i3Sqcz7jE7DZHxkC0n9wdaPJETmIK3Gdiz5Tlc0smofL21B0ZaPHcWYeY1bWanpzGNaIYh_WdFyZAGPF84J39dLm7GlHgu1li74_W3hm&sai=AMfl-YSI1yzXz4aPDyFmcH_L7EaVqiV1_AJ4Nr0BTkOuuzbIPAzCr0Y6edvD0YjlY0_sk6_ul6XjUnR7hRrMv3VV6_R9rtF1nPYJ5TqFZDELv8fJME52TlMprW_D6DkzaouheAedVkTR0qtf&sig=Cg0ArKJSzKDWxN1StM-kEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Wed, 29 Nov 2023 15:43:05 GMT
truncated
/ Frame 5433 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1d9e0d05669a3610c7263c551b8b406344c148713485f7e8124f61b05e2463cd

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
popup.html
rumcdn.geoedge.be/rbu/ 		40 KB
22 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://rumcdn.geoedge.be/rbu/popup.html
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.26.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-26-75.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8496667e6ca10b43d843e825b1f87efa7afc417328b26f815c1b3c5b533ec1a8

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:21:35 GMT
x-amz-version-id
syIMtMYORg3qGAt5iZTB_5DSJtjB6jsO
content-encoding
br
via
1.1 ca339b9e98820e424be1609317fd0314.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P7
age
1292
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 08 Aug 2023 11:45:58 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1691495156/ctime:1691495156/gid:497/gname:jenkins/md5:52896e48320c4224eb8de1f2c93cb04d/mode:33188/mtime:1691495156/uid:498/uname:jenkins
etag
W/"52896e48320c4224eb8de1f2c93cb04d"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/html
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
x-amz-cf-id
gPc8EkU6L9ikeHno6bEKrBhD_NniT73VhPvde8cQB2S01LomPM63LA==
sodar
pagead2.googlesyndication.com/getconfig/ 		16 KB
12 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202311150101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
76fc8b36e6351a6d7b756f4f25805f1389c5b5862f5d1fa7d21b1acf2de15423
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12254
x-xss-protection
0
/
www.googleadservices.com/pagead/conversion/855967303/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/855967303/?random=1701272585875&cv=11&fst=1701272585875&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&label=HsWbCMacxuUDEMeMlJgD&hn=www.googleadservices.com&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&value=0&bttype=purchase&auid=1153095268.1701272584&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
130cf3b5ec74e427ebbda3f25bf2e3fd316aa1e25fc47736aab0a76b458dea76
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1689
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
push_notif.js
services.epoch.cloud//public-labs/src/push_notifications/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://services.epoch.cloud//public-labs/src/push_notifications/push_notif.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0523c13750f634735ff97f98cc6b2d0100bc0aab4d8f703ad3b6952731d7a545

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 17 Sep 2020 15:46:03 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
790
etag
W/"5f6384bb-18fb"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qXMvdqQlR8EbxEbDuQKxFsD3%2BP9wXld2779AkTPP07qMGfAU8TLibJfFI3JmRHr5zDxdp2%2BsDpC4NDgzFihaAKl5yhbRP6hYGGOZQcUzx6vaG56VQyP%2B10F5InqHUElpJe8CeAHcMVv054su1JBG6srSKw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400
cf-ray
82dbf6ddba200e2b-MXP
alt-svc
h3=":443"; ma=86400
ge.js
s3-us-west-2.amazonaws.com/jsstore/a/5N0H11N/ 		59 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s3-us-west-2.amazonaws.com/jsstore/a/5N0H11N/ge.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.92.178.24 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-west-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
d20db6c1df31874b999f525e1eb15c5041d7b5b94c7336754c97d72fca64c1f1

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:07 GMT
Last-Modified
Tue, 29 Aug 2023 17:44:45 GMT
Server
AmazonS3
x-amz-request-id
SPMWSYAJM9YZZS11
ETag
"b54fadc7e5991d9914d62a0459bfdf77"
x-amz-server-side-encryption
AES256
Content-Type
application/javascript
Cache-Control
max-age=2592000
Accept-Ranges
bytes
Content-Length
60527
x-amz-id-2
6/Zz8crku/1fg4IGr3wSnubRkoLO4vfM6AdlOSWwnX4XsOs1cs318OeVHebRz5C5MjUyThIGD7Q=
Expires
Thu, 28 Sep 2023 17:44:44 GMT
destination
www.googletagmanager.com/gtag/ 		192 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/destination?id=G-2601429205&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5Z8H4H
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9060be2fc8322a6ca1cb172cc5090ad393327ea6a993f01b1ad7a662db265ee2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:05 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
72702
x-xss-protection
0
last-modified
Wed, 29 Nov 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 29 Nov 2023 15:43:05 GMT
b413bf4fa936cc351ac6476e0df69b50.js
clientcdn.pushengage.com/core/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://clientcdn.pushengage.com/core/b413bf4fa936cc351ac6476e0df69b50.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
br
cdn-edgestorageid
1080
cdn-cachedat
11/26/2023 16:55:52
cdn-pullzone
1148540
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
403
etag
W/"d4-XcAaV/tWYAkzFEISrPu73u/tTT8"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
cache-control
public, max-age=432000
cdn-requestid
c331e2e8c6e06b9991a5bda3566cc486
cdn-requestcountrycode
CH
cdn-status
403
cdn-requestpullsuccess
True
collect
region1.google-analytics.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-2601429205&gtm=45je3b81z86373291&_p=1701272584324&gcd=11l1l1l1l1&dma=0&cid=468256303.1701272584&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1701272585&sct=1&seg=0&dl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&dt=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&uid=&en=Funnel%20%231%20-%20All%20Check%20Out%20Users&_fv=1&_ss=1&up.region_id=www.theepochtimes.com&up.login_status=anonymous&tfd=3546
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-2601429205&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:05 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
senddata
subsapi.epoch.cloud/db/ 		16 B
345 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://subsapi.epoch.cloud/db/senddata
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/_next/static/chunks/668f0bba-02f16f3e7b11d0d2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TIkAAgx9pOUnUynmcHCmfHGOGtn5stiPs0YphbCSFYAQYhpz8Kl27jb%2BHS%2FXTq8kBtduBxivjYRIWsrG4LpCVX2t4BmyTfywUt%2FWn6nFEoUvk%2Fq4%2BMthLahspniKRCQ2KvGFgWnpThH0SItelTljW707"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET, POST, OPTIONS, PUT, DELETE
access-control-allow-origin
*
content-type
text/plain; charset=utf-8
cf-ray
82dbf6e0195a374c-MXP
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
content-length
16
alt-svc
h3=":443"; ma=86400
senddata
subsapi.epoch.cloud/db/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://subsapi.epoch.cloud/db/senddata
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods
GET, POST, OPTIONS, PUT, DELETE
access-control-allow-origin
*
allow
GET, POST, PUT, DELETE
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
82dbf6de8fec374c-MXP
content-length
0
date
Wed, 29 Nov 2023 15:43:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uQL64US%2FzP6%2BLX6J1rBjz1gcasS97mZedwsL3kylFBSOGiuyBQMqM%2BNJ%2BEhTA%2FpY8DWUxll8xVSbyxvFPwgONCUHjQrVejZ2XlLxfwULAvRxedJRXcGGuNMqxvvEWMlNzD%2F37VPZl3o%2BcXeslnsb0vlt"}],"group":"cf-nel","max_age":604800}
server
cloudflare
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 29 Nov 2023 15:43:06 GMT
grumi.js
rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/ Frame 19C1 		220 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.26.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-26-75.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6486dc0dd88f16d057de0089d5d280dd337fe701d214fe983e8a5296b547ef23

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:21:39 GMT
x-amz-version-id
q7zqv.uEOfOJikhhuTCVfETBlbbOohyX
content-encoding
br
last-modified
Wed, 29 Nov 2023 15:20:04 GMT
server
AmazonS3
via
1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P7
etag
W/"c110f54d29d688f94293c6e6e7a34a5b"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
age
1288
x-amz-cf-id
6VPmrXKFgDIrGj9HPx6VAxW1KdtPN97ci_jTJLqLGusIlC6FLSX1tg==
css2
fonts.googleapis.com/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;700&display=swap
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e40dbc6da95b47d932014e5a93f35b13a341a37ea6fe7559dca041dc77271cd6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 29 Nov 2023 15:40:40 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 29 Nov 2023 15:43:06 GMT
truncated
/ 		665 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5d103df41045bc8e9538ed05d79fdd7750af623fa8dd55fdc3b74d90d6ba20a0

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		19 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
52c854815f543b120f9314bf012a95ff9902edef46b232928855005edd9cf67c

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
/
www.google.ch/pagead/1p-conversion/855967303/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/855967303/?random=5882597&cv=11&fst=1701272585875&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1...
  • https://www.google.com/pagead/1p-conversion/855967303/?random=5882597&cv=11&fst=1701272585875&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2...
  • https://www.google.ch/pagead/1p-conversion/855967303/?random=5882597&cv=11&fst=1701272585875&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2F...
42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ch/pagead/1p-conversion/855967303/?random=5882597&cv=11&fst=1701272585875&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&label=HsWbCMacxuUDEMeMlJgD&hn=www.googleadservices.com&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&value=0&auid=1153095268.1701272584&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ04tYnF3WVF5TW45NXUtMzhQdUxBUkltQVBjeVZCWlVtUGkzeThUaE8xcDcwOEdsSENIbkhLcm5Qenl2LVFyUnJoYThXZ2JMOWFFGlhDaEFJZ04tYnF3WVE3dV9WaTktWHBlVkJFaTRBNTV1dy1IRmJlOTVsLXc2bDZoZ2I1Z0NPc3BLUGh4U2lacHRzTDVDbnBKNUZRS2tXSXdUNzdDNzQzUjBkIhMIh4qfocbpggMVIar9Bx1PFw3Q&is_vtc=1&ocp_id=ClxnZYddodT27w_PrrSADQ&cid=CAQSKQDICaaN4TtIZMt2-VOgwCub4zIZzPVbVT2EfvSDbZ8uf3O0d8vzu_Hk&eitems=ChAIgN-bqwYQ8ImJ5M24qtINEh0AkK_A4kbb5gGZYw7MUQaPRCN6R0w2KRvtnGdJmQ&random=3191106765&ipr=y
Protocol
H3
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:06 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:06 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.ch/pagead/1p-conversion/855967303/?random=5882597&cv=11&fst=1701272585875&bg=ffffff&guid=ON&async=1&gtm=45He3b81v6373291&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&label=HsWbCMacxuUDEMeMlJgD&hn=www.googleadservices.com&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&value=0&auid=1153095268.1701272584&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ04tYnF3WVF5TW45NXUtMzhQdUxBUkltQVBjeVZCWlVtUGkzeThUaE8xcDcwOEdsSENIbkhLcm5Qenl2LVFyUnJoYThXZ2JMOWFFGlhDaEFJZ04tYnF3WVE3dV9WaTktWHBlVkJFaTRBNTV1dy1IRmJlOTVsLXc2bDZoZ2I1Z0NPc3BLUGh4U2lacHRzTDVDbnBKNUZRS2tXSXdUNzdDNzQzUjBkIhMIh4qfocbpggMVIar9Bx1PFw3Q&is_vtc=1&ocp_id=ClxnZYddodT27w_PrrSADQ&cid=CAQSKQDICaaN4TtIZMt2-VOgwCub4zIZzPVbVT2EfvSDbZ8uf3O0d8vzu_Hk&eitems=ChAIgN-bqwYQ8ImJ5M24qtINEh0AkK_A4kbb5gGZYw7MUQaPRCN6R0w2KRvtnGdJmQ&random=3191106765&ipr=y
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 19C1 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvWP_oAvvn20U3XdFq7qeAoxw-VZoprRFjMeolRWgBk4EtpzqShhQlrU4i6WjfeevrrK2QuHpxl23Cb6FP7gnQhi4yzkly4ctK_eCBsFGXEiZossPEaFBd83gVFdTlm7cImF5xTUzcO--t6uEpgZrixomB7Ol5LGUvg8E-_mRc_KXEo-lgoLgakiGEdfXTwFvBAAIDnIYycVZDMBWIHikRQRvPrGFR2G2aJkvxG7Zk8wMqjQ1pcgwpL0zieizwz3bbSxYpE5UJc-hAd5KENYnXzFa3XlUT8XICDmcTuCbJEoQ6bJB207Cbo_JXXfUSFNGi9k1JyVcapFhWk6qmQpe0SMagqMr4TOI06FP1TOHh_Rsb8Aks2NHRsfAEGa1bl-WkMmbIhEgCbk3Nu1PtxbAMUmQPQ98A6JrSIA6E&sai=AMfl-YSnPUJHzUiiwCsC9ZXgVqLRRwWk_ZJI88Sr8G0kvu6SEF3B1P3vkjPUh1YtmnXRvmcP4Y6HhO-2au5X99HnSFtMhE0lPzeUOMyRdO3czUxXKIlFiQ3BT0fTvBtzNzge9hEVrKyxK5al1g&sig=Cg0ArKJSzNU3RWQUuur9EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame 19C1 		202 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65070
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1700193896630564"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 29 Nov 2023 15:43:08 GMT
2623904537798289538
tpc.googlesyndication.com/simgad/ Frame 19C1 		79 KB
79 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/2623904537798289538?
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d038bbb5fa50aaa04d7e4f9a854820241ba594bdaf8275c5f004617b15c9ee30
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 24 Nov 2023 17:54:36 GMT
x-content-type-options
nosniff
age
424110
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
81325
x-xss-protection
0
last-modified
Fri, 27 Oct 2023 14:15:04 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 23 Nov 2024 17:54:36 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D553 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

accept-ranges
bytes
age
664
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 15:32:02 GMT
expires
Thu, 28 Nov 2024 15:32:02 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 3D12 		829 B
984 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
5811e5f3ab7f3f38906a81cfe0de05e194541de092bc539f2c7287a20c6e1c28
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-3ZSrMTRwb53IZVE6xtPBXQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-3ZSrMTRwb53IZVE6xtPBXQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 15:43:06 GMT
expires
Wed, 29 Nov 2023 15:43:06 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
uclick.json
securegames.iwin.com/provider/ Frame 980F 		781 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/provider/uclick.json
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
d651ad7eae445421bd7bcc1b311239cfe95f65f9816703fc534c5f83435aa25f

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://securegames.iwin.com/m/console/v_313/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:34:42 GMT
Access-Control-Request-Method
*
Via
1.1 3d60650fd0c339e18e816ce29f9a0da0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
1699
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
781
X-UA-Compatible
IE=Edge,chrome=1
Last-Modified
Thu, 26 Oct 2023 21:12:31 GMT
ETag
"653ad63f-30d"
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, PUT, DELETE, GET, OPTIONS
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
X-Amz-Cf-Id
dV7OxS3tOW9UseF9AGknqxezlf3Yft7uRalNkPbNcM5fZmh2yzfGHQ==
Expires
Tue, 28 Nov 2023 17:08:44 GMT
uclick.json
securegames.iwin.com/provider/ Frame 980F 		781 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/provider/uclick.json
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
d651ad7eae445421bd7bcc1b311239cfe95f65f9816703fc534c5f83435aa25f

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://securegames.iwin.com/m/console/v_313/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:34:42 GMT
Access-Control-Request-Method
*
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
1699
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
781
X-UA-Compatible
IE=Edge,chrome=1
Last-Modified
Thu, 26 Oct 2023 21:12:31 GMT
ETag
"653ad63f-30d"
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, PUT, DELETE, GET, OPTIONS
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
X-Amz-Cf-Id
IRCQg43ec4LaignROy5tBg7HtdAQgEsHDnuk0MCIwZf5cRtsJkChAg==
Expires
Tue, 28 Nov 2023 17:08:44 GMT
/
securegames.iwin.com/m/uclick/spotthedifference/v_8/ Frame C830 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
a60d175e01e51a0456c5ae6b6f1db85ed996f99c3b20d6d1d66c721b66e4ac8b

Request headers

Referer
https://securegames.iwin.com/m/console/v_313/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Accept-Ranges
bytes bytes
Age
7033997
Cache-Control
public, max-age=31536000
Connection
keep-alive
Content-Encoding
gzip
Content-Length
1523
Content-Type
text/html
Date
Sat, 09 Sep 2023 05:49:49 GMT
ETag
"3315605744+gzip"
Expires
Sun, 08 Sep 2024 05:49:49 GMT
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
Vary
Accept-Encoding
Via
1.1 c318f6c5edde4e7ab2b9ba2243b14b28.cloudfront.net (CloudFront)
X-Amz-Cf-Id
7fsLz_INkWeF-WfNplLvh2ZoGmhNY2P1Qsh_0x84M4sAnwC9-_IAEA==
X-Amz-Cf-Pop
MUC50-P4
X-Cache
Hit from cloudfront
stf.js
d7d3cf2e81d293050033-3dfc0615b0fd7b49143049256703bfce.ssl.cf1.rackcdn.com/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d7d3cf2e81d293050033-3dfc0615b0fd7b49143049256703bfce.ssl.cf1.rackcdn.com/stf.js?v=2023-11-29T15
Requested by
Host: services.epoch.cloud
URL: https://services.epoch.cloud/public-labs/epoch-ai/smarto/et_so_utils.js?v=2023-11-29T15
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.238.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-238-237.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
27d67175ee9fdf263362ffaf194a4244d29c77f3dd277473d018cd2e2f704cbb

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:06 GMT
Content-Encoding
gzip
Origin
https://mycloud.rackspace.com
Last-Modified
Thu, 21 Sep 2023 08:44:12 GMT
ETag
0d37391e8a5f279465d0e10237e522ba
Vary
Accept-Encoding
Content-Type
text/javascript
X-Timestamp
1695285851.87047
Cache-Control
public, max-age=250089
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx0b792868ce034dd3b705a-006567387edfw1
Content-Length
4958
Expires
Sat, 02 Dec 2023 13:11:15 GMT
gtm.js
www.googletagmanager.com/ Frame 980F 		166 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WQW49ZB
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b49f0f3da5e676191fba5a73b30240e440586db2ca200d13b4501dd5184d700d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
61207
x-xss-protection
0
last-modified
Wed, 29 Nov 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 29 Nov 2023 15:43:06 GMT
bootstrap2.css
securegames.iwin.com/m/uclick/spotthedifference/v_8/css/ Frame C830 		125 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/css/bootstrap2.css
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
7b89cffa52f19d5b7fe006af822e200718ca99c3ae6d5bfe3101991ca803e588

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 25 Sep 2023 12:55:49 GMT
Content-Encoding
gzip
Via
1.1 c318f6c5edde4e7ab2b9ba2243b14b28.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
5626037
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
18599
Last-Modified
Mon, 05 Jun 2017 11:20:06 GMT
ETag
"1842088087+gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
3j-PtfeWChoktDgSv7ajHT-QehJKQsUuINJhOE0vG4xgTImA_h8CrQ==
Expires
Tue, 24 Sep 2024 12:55:49 GMT
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/ Frame C830 		118 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
946
age
2368077
cdn-cachedat
07/16/2022 17:20:00
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
cdn-proxyver
1.02
cdn-requestpullcode
200
server
cloudflare
etag
W/"2f624089c65f12185e79925bc5a7fc42"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
832348373d0a364e389dea72fefb740d
timing-allow-origin
*
cdn-requestcountrycode
FR
cdn-status
200
cf-ray
82dbf6e00b42f188-CDG
cdn-requestpullsuccess
True
game.css
securegames.iwin.com/m/uclick/spotthedifference/v_8/ Frame C830 		747 B
889 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/game.css
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
7646b2bb1cdb33243d053bc1dd166226cb25b119948f39f81f38244803f85288

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 17 Sep 2023 17:23:45 GMT
Content-Encoding
gzip
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
6301160
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
333
Last-Modified
Mon, 05 Jun 2017 11:20:07 GMT
ETag
"4249499355+gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
uji_RA0A9FlT7KdXmwkGxE7KnLZ6AOW5K5qNh2lxPHMwyimgsss_uw==
Expires
Mon, 16 Sep 2024 17:23:45 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.11.0/ Frame C830 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 23 Nov 2023 08:17:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
545153
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33576
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 22 Nov 2024 08:17:13 GMT
jquery-ui.js
code.jquery.com/ui/1.10.2/ Frame C830 		426 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/ui/1.10.2/jquery-ui.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
1203ee412fb623c6e6daeddbdebd5d2541223b9e9aff17991978939cd4ef6193

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
1831677
x-cache
HIT, HIT
content-length
106990
x-served-by
cache-lga21967-LGA, cache-mxp6973-MXP
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1701272586.242579,VS0,VE0
etag
W/"28feccc0-6a79a"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
4724, 58
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/ Frame C830 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
1072
age
1759633
cdn-cachedat
12/25/2022 15:12:24
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
cdn-proxyver
1.03
cdn-requestpullcode
200
server
cloudflare
etag
W/"c5b5b2fa19bd66ff23211d9f844e0131"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
84ddc193684ac3a45d75e8852ca4d51f
timing-allow-origin
*
cdn-requestcountrycode
FR
cdn-status
200
cf-ray
82dbf6e00b47f188-CDG
cdn-requestpullsuccess
True
jquery.plugin.js
securegames.iwin.com/m/uclick/spotthedifference/v_8/js/ Frame C830 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/jquery.plugin.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
3ebcd7d59c2e596630fee4b6f1500f960e63f514a6816f11031c2d484d1f2683

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 25 Sep 2023 12:55:49 GMT
Content-Encoding
gzip
Via
1.1 3d60650fd0c339e18e816ce29f9a0da0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
5626036
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
3707
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"3362232284+gzip"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
ksMgEoLyDWev21Ed5LBbGDhRfVzhCovexM0itTgOat63eaZd97kHqQ==
Expires
Tue, 24 Sep 2024 12:55:49 GMT
jquery.datepick.js
securegames.iwin.com/m/uclick/spotthedifference/v_8/js/ Frame C830 		94 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/jquery.datepick.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
e5d558dc4fd6e6fcb8439f66cf4f2495568d312f91982ab3520cddc8c40479e9

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 13 Sep 2023 04:07:46 GMT
Content-Encoding
gzip
Via
1.1 5f2f5e879d7e38fec917517376aca8bc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
6694520
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
21598
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"3960843854+gzip"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
LORC5IgJ_0xa00PYY48dIj0I2oEZxPSMzean01SImvUAK0z471iFNA==
Expires
Thu, 12 Sep 2024 04:07:46 GMT
bootstrap.js
securegames.iwin.com/m/uclick/spotthedifference/v_8/js/ Frame C830 		57 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/bootstrap.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
b16aedf23eaa640fda30eb3cf864dc22c80c0a50d32b9ab5d537f291f66d74ca

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 27 Sep 2023 00:36:11 GMT
Content-Encoding
gzip
Via
1.1 3d60650fd0c339e18e816ce29f9a0da0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
5497615
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
10900
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"2350399949"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
jg9Pn4g8i8D2VvrXjJ91aZC1CnMNL7MtBGNd0_p3H58D8q2pr-IvFg==
Expires
Thu, 26 Sep 2024 00:36:11 GMT
bootstrap-datepicker.js
securegames.iwin.com/m/uclick/spotthedifference/v_8/js/ Frame C830 		46 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/bootstrap-datepicker.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
7408a7e4e9cbe0a4e20392af93833af4ddcf9a21934cd9424ccccd0c10e41d6b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 09 May 2023 10:00:05 GMT
Content-Encoding
gzip
Via
1.1 4a60bbb27ed6c12061c306cd2a16e4fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
17646180
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
12172
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"2422384158+gzip"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
6HCPGD8tfR_sc5ArF5Vob3XkIHMBS5NJm1taNF_Q5UfN0XR0Bzl4VQ==
Expires
Wed, 08 May 2024 10:00:05 GMT
createjs.min.js
securegames.iwin.com/m/uclick/spotthedifference/v_8/js/ Frame C830 		186 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 09 Sep 2023 12:16:40 GMT
Content-Encoding
gzip
Via
1.1 5f2f5e879d7e38fec917517376aca8bc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
7010786
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
49344
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"3554431102"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
OqM91YTNFG48XEpyaS5daOMlzxoK838FILEa_V9v8XtnNUlGaQvP-w==
Expires
Sun, 08 Sep 2024 12:16:40 GMT
bitmapfont.min.js
securegames.iwin.com/m/uclick/spotthedifference/v_8/js/ Frame C830 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/bitmapfont.min.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
047fb9e91e2679dcce438ec8dfe0dad52442ebf73aa92bb1fb797f0c4e0d42d1

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 18 May 2023 04:51:00 GMT
Content-Encoding
gzip
Via
1.1 c318f6c5edde4e7ab2b9ba2243b14b28.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
16887126
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
2753
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"17011108"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
qd4W7MI66xnM9VcpmAMqUI0L8h-utY_smZ2qD89rvbWVBkLOVZZW1A==
Expires
Fri, 17 May 2024 04:51:00 GMT
main.js
securegames.iwin.com/m/uclick/spotthedifference/v_8/js/ Frame C830 		36 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/main.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
b87db941ea15f78cb56978d7ebd689d68e4db1a4f50c40a7e217a8498c487593

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 13 Sep 2023 04:07:46 GMT
Content-Encoding
gzip
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
6694520
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
8568
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"2691016218+gzip"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
GmQ25TmPxyLlbreEOQBlHK4JkFTOx7LBTzJcYqFUT-i6fOxPsJItWg==
Expires
Thu, 12 Sep 2024 04:07:46 GMT
iconsole.js
securegames.iwin.com/m/uclick/spotthedifference/ Frame C830 		82 B
647 B 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/iconsole.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
c704422aafb675b9272447d343329391f479d4aab004700782886ffee2a244f9

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 25 Sep 2023 12:55:50 GMT
Content-Encoding
gzip
Via
1.1 e962a4214db0639b31056a5ae4bf22f4.cloudfront.net (CloudFront)
Last-Modified
Fri, 11 Nov 2016 09:50:10 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
5626036
ETag
"3113047670"
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
X-Amz-Cf-Id
ZJI9vojUQHd8tHOCyfCLfPWwc2Eu8EwkL9ZQtBO-jTZn_stBLTQ2bA==
Expires
Tue, 24 Sep 2024 12:55:50 GMT
GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js
pagead2.googlesyndication.com/bg/ Frame D553 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:18:01 GMT
content-encoding
br
x-content-type-options
nosniff
age
1505
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15296
x-xss-protection
0
last-modified
Mon, 06 Nov 2023 16:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 28 Nov 2024 15:18:01 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 3D12 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202311150101&jk=4399728119757086&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
js
www.googletagmanager.com/gtag/ Frame 980F 		260 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-YRPJEL47G4&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WQW49ZB
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
32dc9f5798555b2f8c07bf8aedf23efb28d934350b3e377a57b47394df7afe06
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
89675
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 29 Nov 2023 15:43:06 GMT
p
ingestion.contentinsights.com/ 		0
88 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ingestion.contentinsights.com/p?a=Epoch%20Puzzles&b=&c=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&d=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&e=Photo%20Games&f=2748&g=2023-11-03T16%3A00%3A23Z&h=epochfun-137957%2Cpuzzle-games-152300%2Cjoypass-free-155614%2Cspecial-epoch-games-155638%2Cbrain-games-156107%2Cfeatured-special-epoch-games-157768%2Cphoto-games-158540%2Cepochfun-premium-166969%2Cfrontaudio-161329&i=&j=free&k=news&l=&m=anonymous&ch=&pid=3956489&u=1701272586274.29376783.274442263&ul=1701272586275.449650498.31516016&x=0.2617614528198904&t=0&err=&ver=21
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.228.144.102 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-144-102.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection
keep-alive
Date
Wed, 29 Nov 2023 15:43:06 GMT
iconsole.js
securegames.iwin.com/m/console/v_313/ Frame C830 		45 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/console/v_313/iconsole.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/iconsole.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
091fa867686554a13fe1d783d79e005350166698d9908dab893e958b88995426

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Jun 2023 16:10:08 GMT
Content-Encoding
gzip
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
14340778
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
13756
Last-Modified
Thu, 08 Dec 2022 10:50:06 GMT
ETag
"756282178+gzip"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
uDc1gdLzyeWSmmar9myfyJvHXA8k5HAEZ5qeKlZk3vX1dSxaQpstXg==
Expires
Sat, 15 Jun 2024 16:10:08 GMT
generate_204
tpc.googlesyndication.com/ Frame D553 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?9LGNIQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
Acta-Medium.otf
img.theepochtimes.com/fonts/ Frame 25DE 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://img.theepochtimes.com/fonts/Acta-Medium.otf
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/css/main.f8b20501.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.19.198.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-198-122.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash

Request headers

Referer
https://comment.youmaker.com/
Origin
https://comment.youmaker.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:06 GMT
Server
nginx
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
text/html
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC
Access-Control-Allow-Credentials
true
Connection
keep-alive
Akamai-Mon-Iucid-Del
1289467
Access-Control-Allow-Headers
origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session
Content-Length
548
Acta-BookItalic.otf
img.theepochtimes.com/fonts/ Frame 25DE 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://img.theepochtimes.com/fonts/Acta-BookItalic.otf
Requested by
Host: comment.youmaker.com
URL: https://comment.youmaker.com/web/v3/static/css/main.f8b20501.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.19.198.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-198-122.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash

Request headers

Referer
https://comment.youmaker.com/
Origin
https://comment.youmaker.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:06 GMT
Server
nginx
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
text/html
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC
Access-Control-Allow-Credentials
true
Connection
keep-alive
Akamai-Mon-Iucid-Del
1289467
Access-Control-Allow-Headers
origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session
Content-Length
548
tentacle.js
tentacles.smartocto.com/ten/ 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tentacles.smartocto.com/ten/tentacle.js?v=2023-11-29T15
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
30cba8c6f7374a344b5a6d97dda6da6f92281144a7123bd7168349de7d85f4b3

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
br
cdn-edgestorageid
1080
cdn-storageserver
DE-383
cdn-cachedat
11/28/2023 09:17:30
cdn-pullzone
1448885
last-modified
Tue, 28 Nov 2023 09:17:22 GMT
server
BunnyCDN-DE1-1080
cdn-fileserver
709
cdn-requestpullcode
200
cdn-proxyver
1.04
etag
W/"6565b022-9011"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
92c47c19-149d-4a6b-809d-6a585867c24c
cache-control
public, max-age=60
cdn-requestid
8be17980317d1f8c7279d7e1d852e704
cdn-requestcountrycode
CH
cdn-status
200
cdn-requestpullsuccess
True
analytics.js
www.google-analytics.com/ Frame C830 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 29 Nov 2023 14:30:31 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
4355
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Wed, 29 Nov 2023 16:30:31 GMT
silence.ogg
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/ Frame C830 		4 KB
4 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/silence.ogg
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
7c6f17e7a639b998b35fa6e575eb805e6efda2789431bd4c30ab2c46bd2345ec

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range
bytes=0-

Response headers

Date
Thu, 23 Nov 2023 10:33:08 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:07 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
536998
ETag
"4051704580"
X-Cache
Hit from cloudfront
Content-Type
application/ogg
Content-Range
bytes 0-3980/3981
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
VvXeOcFYnDSCosvQQGfr3smR5N57vrVIr5KpwdyN_SS1Olbv1QDGNg==
Content-Length
3981
Expires
Thu, 30 Nov 2023 10:33:08 GMT
sdk.js
connect.facebook.net/en_US/ Frame 980F 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
ebeb5e1c053b28845daac052c0949fcbfb8ab11eb3aaf72ce792cdfde27ee51d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 29 Nov 2023 15:43:06 GMT
content-md5
rZAT5qvRZQpNDwvM7/PHSw==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1686
reporting-endpoints
x-fb-debug
9PCDxGZL73Ji99rsRA4SHK/gFRBNtbf9yyr/EPOcJtKX6rJYyppAV2sMyvcpRsswguuA6laOrTHB0ZGLXu8UBg==
x-fb-content-md5
97a6a8a26862e5fbe4a011257299d9ec
cross-origin-opener-policy
same-origin-allow-popups
etag
"8b21f50d506be043e3c3ae79ae48de46"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Wed, 29 Nov 2023 15:48:50 GMT
linkid.js
www.google-analytics.com/plugins/ua/ Frame C830 		2 KB
722 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:18:33 GMT
content-encoding
br
x-content-type-options
nosniff
age
1473
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
697
x-xss-protection
0
last-modified
Fri, 30 Jun 2023 18:58:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Wed, 29 Nov 2023 16:18:33 GMT
date.php
securegames.iwin.com/m/uclick/spotthedifference/v_8/js/ Frame C830 		76 B
617 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/date.php
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
8c8838d55e3dee87762d5bf4fd2b1df3a7e773d58c2133022ae43d7ba8c6a930

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 13 Sep 2023 04:07:46 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6694520
ETag
"2135448859"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
76
X-Amz-Cf-Id
PL8Rm_lXgyQ4hoI77FT0GN0xpXNPvUlRlYkikuUEI0nqVEoPpgkviA==
Expires
Thu, 12 Sep 2024 04:07:46 GMT
logo.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		7 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/logo.png
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
a26f2837af50af431970d8d6c86ab1f2354b33258517cfed4e75c3b9eae272fa

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 16 Nov 2023 17:09:15 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
1118031
ETag
"2917151474"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
6935
X-Amz-Cf-Id
pmCFnRekAJjHHIiqRiiJXbDZHprcFjhUbRZXbV86hsm8dZZMT9JwTQ==
Expires
Fri, 15 Nov 2024 17:09:15 GMT
sdk.js
connect.facebook.net/en_US/ Frame 980F 		302 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=ebca6a25bf83245fede988871e166228
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
ccfd8c01d2da74b0d0530b80106aeadb0b46adbe764c2f023e5760374090aa05
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://securegames.iwin.com/
Origin
https://securegames.iwin.com
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 29 Nov 2023 15:43:06 GMT
content-md5
MgJYKJw/nLRZRjN539/scQ==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
88318
reporting-endpoints
x-fb-debug
lVqL60M8z8NzUKeuRTLrthpcOVeuONv0Upsoq0xGHp9A9+wv+BXu2VuHOpgQwG6Ot7/E4BB/fBy2ofKnVA1meA==
x-fb-content-md5
3f3e08c798967a646969043453f72bc5
cross-origin-opener-policy
same-origin-allow-popups
etag
"35cee505ee58853843a2eb7d9a193d0a"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
priority
u=3,i
expires
Thu, 28 Nov 2024 11:58:05 GMT
7f4bdcc5-0273-4562-b34a-6efead237c10
https://securegames.iwin.com/ Frame C830 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/7f4bdcc5-0273-4562-b34a-6efead237c10
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a26f2837af50af431970d8d6c86ab1f2354b33258517cfed4e75c3b9eae272fa

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
6935
Content-Type
image/png
stdd231129_hd.xml
picayune.uclick.com/comics/stdd/data/ Frame C830 		902 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://picayune.uclick.com/comics/stdd/data/stdd231129_hd.xml
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.188 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
66de8327e8ba8313b51ce1152038d53d24bb3b0c6e4e6ef8a055d06f92b9ab2d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:06 GMT
Last-Modified
Wed, 29 Nov 2023 06:20:01 GMT
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/xml
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length
902
activeview
pagead2.googlesyndication.com/pcs/ Frame 5433 		42 B
174 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvjX4AzrOMeidtugKElaM7yw4OrzeyJ2TZJttXmMy8LSa6GMAm88kVOTchGJreWRULcJnnVxbHSOSZop2T8Nwu44v4kk-kNF0rEn36J4eD0Q1Svfd8LAg-uMMo0iD7hXwT0nEdLWVG4Hw&sai=AMfl-YQpRGwYg_sIJSLHfIKXsfkSSHHLeK1OZ0ZYhrN01tKnyKGgoUw&sig=Cg0ArKJSzPMbo5jQFpZ1EAE&id=lidar2&mcvt=1000&p=210,1152,460,1452&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231116&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=2135588503&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701272585232&rpt=414&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:06 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ingestion.js
tentacles.smartocto.com/ten/ 		10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tentacles.smartocto.com/ten/ingestion.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
4d5ffa9b4660a2cb3cc7733dd785224252768155d96805b19b862ef55af6d045

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
br
cdn-edgestorageid
1080
cdn-storageserver
DE-677
cdn-cachedat
11/28/2023 09:17:30
cdn-pullzone
1448885
last-modified
Tue, 28 Nov 2023 09:17:20 GMT
server
BunnyCDN-DE1-1080
cdn-fileserver
709
cdn-requestpullcode
200
cdn-proxyver
1.04
etag
W/"6565b020-2774"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
92c47c19-149d-4a6b-809d-6a585867c24c
cache-control
public, max-age=60
cdn-requestid
8577f735c8a1946d90e20ce45d69a671
cdn-requestcountrycode
CH
cdn-status
200
cdn-requestpullsuccess
True
tentacles
api.smartocto.com/api/brands/ 		1 KB
889 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.smartocto.com/api/brands/tentacles?i=8ia94jzjaallopuwrqi7yg96qevd0z0w
Requested by
Host: tentacles.smartocto.com
URL: https://tentacles.smartocto.com/ten/tentacle.js?v=2023-11-29T15
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.249.188.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-249-188-76.eu-west-1.compute.amazonaws.com
Software
/ smartocto
Resource Hash
a55cd6de4655dc7bb21259ded6fb10e73640436324b5eb7f01c6a450baefa7df

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
gzip
last-modified
Wed, 29 Nov 2023 15:42:57 +0000
max-age
10
x-powered-by
smartocto
vary
Accept-Encoding
x-cache
HIT from SmartOcto Cache
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.theepochtimes.com
access-control-allow-methods
GET,PUT,POST,DELETE
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
/
onetag-sys.com/usync/ Frame 2E8D 		2 KB
863 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?cb=1701272584464
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
usersync.html
cdn.undertone.com/js/ Frame B612 		12 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.undertone.com/js/usersync.html
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-79.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0e4bc8f1a2c59e9e8e12e9f32a6812c46570925e9f72770d1475d8a1ee85476b

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

age
25048
content-encoding
gzip
content-type
text/html
date
Wed, 29 Nov 2023 08:45:40 GMT
etag
W/"9f69f355a69e650f4a86354e76e60d40"
last-modified
Tue, 18 Jul 2023 10:31:18 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 d11d7fba872e54649066e59f703ad3e6.cloudfront.net (CloudFront)
x-amz-cf-id
mrlOPalhYolviZY9irj-h2cVbDI2fyGtIm6MydOwZbHjMr0XvVpdzA==
x-amz-cf-pop
MUC50-P3
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
5cDzvCPt5iTw_HTWM8q.kHMVnUk7Smec
x-cache
Hit from cloudfront
usersync.html
cdn.undertone.com/js/ Frame 2FC4 		12 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.undertone.com/js/usersync.html
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-79.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0e4bc8f1a2c59e9e8e12e9f32a6812c46570925e9f72770d1475d8a1ee85476b

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

age
25048
content-encoding
gzip
content-type
text/html
date
Wed, 29 Nov 2023 08:45:40 GMT
etag
W/"9f69f355a69e650f4a86354e76e60d40"
last-modified
Tue, 18 Jul 2023 10:31:18 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 d11d7fba872e54649066e59f703ad3e6.cloudfront.net (CloudFront)
x-amz-cf-id
lCsZYLlt5R2Y1cwIeMH_KkPuJ3AcIdn63RDZ9zYc5FeqWQSZLGqWvQ==
x-amz-cf-pop
MUC50-P3
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
5cDzvCPt5iTw_HTWM8q.kHMVnUk7Smec
x-cache
Hit from cloudfront
cs.html
sdk.minutemedia-prebid.com/cs-config/ Frame 5B53 		3 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sdk.minutemedia-prebid.com/cs-config/cs.html?org=6475aa705b23100001019b46&tc=6475aaf65fe06700018e50d8&as=6475aaf65fe06700018e50da&type=hb&wd=cs.minutemedia-prebid.com&domain=theepochtimes.com
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.192.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-192-26.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f48a6d82840fe8d6952bd2570b2f0a960b42bba1b10d4786b0564f04be87fa19

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

accept-ranges
bytes
age
27732
content-length
3480
content-type
text/html
date
Wed, 29 Nov 2023 08:01:14 GMT
etag
"a0a441bd34ade33598ec2a72125b5709"
last-modified
Wed, 22 Mar 2023 13:07:05 GMT
server
AmazonS3
via
1.1 8eb3c67b1958af32e15515c8eb27fbb4.cloudfront.net (CloudFront)
x-amz-cf-id
XE4FCUA-1g-1xndewaKjblJUbTyiAKOEetLCG-rm6X0hZV7Nfrborw==
x-amz-cf-pop
MUC50-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
/
onetag-sys.com/usync/ Frame F217 		2 KB
863 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?cb=1701272584481
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
usersync.html
cdn.undertone.com/js/ Frame F0CA 		12 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.undertone.com/js/usersync.html
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-79.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0e4bc8f1a2c59e9e8e12e9f32a6812c46570925e9f72770d1475d8a1ee85476b

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

age
25048
content-encoding
gzip
content-type
text/html
date
Wed, 29 Nov 2023 08:45:40 GMT
etag
W/"9f69f355a69e650f4a86354e76e60d40"
last-modified
Tue, 18 Jul 2023 10:31:18 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 d11d7fba872e54649066e59f703ad3e6.cloudfront.net (CloudFront)
x-amz-cf-id
q63IDWNmyaBTYQdsp_BW_0BpTyp0AqO1YrdPQ_bVbsCqPdlLrnJ1eg==
x-amz-cf-pop
MUC50-P3
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
5cDzvCPt5iTw_HTWM8q.kHMVnUk7Smec
x-cache
Hit from cloudfront
/
onetag-sys.com/usync/ Frame 4539 		2 KB
863 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?cb=1701272584463
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
usersync.html
cdn.undertone.com/js/ Frame D7D9 		12 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.undertone.com/js/usersync.html
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-79.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0e4bc8f1a2c59e9e8e12e9f32a6812c46570925e9f72770d1475d8a1ee85476b

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

age
25048
content-encoding
gzip
content-type
text/html
date
Wed, 29 Nov 2023 08:45:40 GMT
etag
W/"9f69f355a69e650f4a86354e76e60d40"
last-modified
Tue, 18 Jul 2023 10:31:18 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 d11d7fba872e54649066e59f703ad3e6.cloudfront.net (CloudFront)
x-amz-cf-id
ZMeFDghWmjMA5wtU2IgYPTg3FEbfK_ZCphGImIHij9ly025KairNMg==
x-amz-cf-pop
MUC50-P3
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
5cDzvCPt5iTw_HTWM8q.kHMVnUk7Smec
x-cache
Hit from cloudfront
/
onetag-sys.com/usync/ Frame 1C93 		2 KB
863 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?cb=1701272584774
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
/
onetag-sys.com/usync/ Frame D32E 		2 KB
863 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?cb=1701272584487
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
usersync.html
cdn.undertone.com/js/ Frame 0223 		12 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.undertone.com/js/usersync.html
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/assets/themes/eet/js/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-79.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0e4bc8f1a2c59e9e8e12e9f32a6812c46570925e9f72770d1475d8a1ee85476b

Request headers

Referer
https://www.theepochtimes.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

age
25048
content-encoding
gzip
content-type
text/html
date
Wed, 29 Nov 2023 08:45:40 GMT
etag
W/"9f69f355a69e650f4a86354e76e60d40"
last-modified
Tue, 18 Jul 2023 10:31:18 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 d11d7fba872e54649066e59f703ad3e6.cloudfront.net (CloudFront)
x-amz-cf-id
hDQFVwRCRki6puOMDMQhZk_kFyHzdq5d3CkIhH3xNL1txv4SKBycOA==
x-amz-cf-pop
MUC50-P3
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
5cDzvCPt5iTw_HTWM8q.kHMVnUk7Smec
x-cache
Hit from cloudfront
lc2.js
b-code.liadm.com/ 		47 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b-code.liadm.com/lc2.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.36.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-36-128.muc50.r.cloudfront.net
Software
/
Resource Hash
b0512ff1ecca4eeaa79eabd6f059915e9cec84022c2f78519acf20d942b628e0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 28 Nov 2023 19:12:58 GMT
content-encoding
gzip
via
1.1 068dc56746723ff514ed3604e029e74e.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P2
age
73809
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
"public, max-age=86400"
x-amz-cf-id
aHMuOKh8-UPxJ0h4LOyA1siDBhi4OT-6pus84V1kFaIf_7fQLkQDKw==
t
ingestion.smartocto.com/ 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ingestion.smartocto.com/t?p=0%3Alpjxrt9k%3Amiu3kHrkCClYQJYCtNy9yRx9Abq5vcrz&s=0%3Alpjxrt9k%3Ai0dl9Lg6KUTEhSDiEyBod6i78SotrbYQ&v=0%3AfR3giORqJ7tfZTnEOrAND93d3cP5tpMX&e=0%3AfR3giORqJ7tfZTnEOrAND93d3cP5tpMX0&c=1701272586731&n=t&f=t&l=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&i=1600&j=1200&k=1&w=1600&h=1200&t=pageView&ch=web&bid=epochtimesus
Requested by
Host: tentacles.smartocto.com
URL: https://tentacles.smartocto.com/ten/ingestion.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.187.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-30-187-221.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.theepochtimes.com
Date
Wed, 29 Nov 2023 15:43:06 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
status
www.facebook.com/x/oauth/ Frame 980F 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/x/oauth/status?ancestor_origins=https%3A%2F%2Fentertainment.service.amuniversal.com%2Chttps%3A%2F%2Fwww.theepochtimes.com&client_id=128296273850064&input_token&origin=1&redirect_uri=https%3A%2F%2Fsecuregames.iwin.com%2Fm%2Fconsole%2Fv_313%2F%23%2Fm%2Fuclick%2Fspotthedifference%2Fv_8%2F%23!uclick&sdk=joey&wants_cookie_data=true
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=ebca6a25bf83245fede988871e166228
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Wed, 29 Nov 2023 15:43:06 GMT
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
reporting-endpoints
default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
pragma
no-cache
x-fb-debug
S5uhHQ4sZt9vZ8+djci+av5+poHrDZX9xV3sgOhE+O+2/P7KqbkWPSEpJYQJv4QQJfvWYFDMO+Pzd36STe4VVA==
fb-s
unknown
report-to
{"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://securegames.iwin.com
access-control-expose-headers
fb-s
cache-control
private, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), payment=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
reading-time.js
tentacles.smartocto.com/ten/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tentacles.smartocto.com/ten/reading-time.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
ce174010dbecc7aec9280ffd46eabfa8189b99d461403f060178a4075a872446

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:06 GMT
content-encoding
br
cdn-edgestorageid
1082
cdn-storageserver
DE-587
cdn-cachedat
11/28/2023 09:17:29
cdn-pullzone
1448885
last-modified
Tue, 28 Nov 2023 09:17:21 GMT
server
BunnyCDN-DE1-1080
cdn-fileserver
382
cdn-requestpullcode
200
cdn-proxyver
1.04
etag
W/"6565b021-19d9"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
92c47c19-149d-4a6b-809d-6a585867c24c
cache-control
public, max-age=60
cdn-requestid
5b9497ced2ebf83ec7e40912ad56135b
cdn-requestcountrycode
CH
cdn-status
200
cdn-requestpullsuccess
True
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202311150101&jk=4399728119757086&bg=!x8SlxIvNAAZxrfrxUa07ADQBe5WfOPMk3vGzVW_gGPETBbi5D4Q5nx6p3tkhkxFUreS2X9SNZYffNrFQ8P6wG619n6gYAgAAAE5SAAAAAmgBB5kCvNhF2Hg9jm_MjDxWGu9ENvjE3l8_AH3xChGaDJR3P5UBz5HU7xCfG0nf4qx2StfjZYv6MJBfDmAeYhhMbrxiwwLa9dol0B4lzMidtSWzCI-kU8X0t5aZ91wqN_cA-nioHvrTGQ8UCRYl98UFxKzoSxe2z5t1JT2ZhTOP8pJeerF8Vq5HClBvLSqqcSvWmhgvLtRjaOiwG6ww4EjyTUWb9Vr7z_YR1vT5jplkWZh7nUFympiwHvaBG_VdNvL5_bRqcF7NDO1_vgsHqAIci0E9nXvUuvR9u1Pm212R647Swv-OcpfWH9-QGwIugpPkGMHea32LIFNCJEafxkjyEc5Pwd4UY15-FC5NJI6eByzyqBTGvrsKDNrl0m-pLzxNvyfEcJUJeNV1P1xkhLZHcoQDCEqRd8qhZUjorGLnE6AZJxyLgRlYAOILOudYJHmOikRbtE5Q5OWRg-KPUw1-Spat9YtbHXg0DT32IHMMEWiZU3WeZcBrrLV9drcFrOktXVZx7d1QBcH7hpA2ehWa8EUdx-lLV7mqzrzXNYSdbws2SZVPvrJmh7CaY6qU5saiV_Yx-7X5dM-_ZT2XaNk0qthVk532QRojIXlPtVR5-hYpwzKeFEwW7spkljYzLm3HFMFq7DdZgCyFY8I8n1l6tpB6Jc0qjDUZ44D7aACRuMmgo7HC_Wtqrz_mQ17WbJdE-KS6UsX9LmpGNoQzR9qfdJHagING4UO8-8sgFxQ5CL0K8gn8kiYGWzRHbx5DPnljsQjg4jsbtHafSb9xVJPu-QwPFmS47goRKNQUC0PsbXjpN7cr_xZ2Ctah9_jv3fCcVsxZkvvBVHNwLwQ7A_rynigLs3n-nHMuEskMgC4rsZ2gNkfDfQRD3pd7jkmSnNGrJTvybTAcwshiFmiVUopXfl83Z6m0pOfGkh_zannzk3g
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
client
accounts.google.com/gsi/ Frame 980F 		199 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/client
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4fb731738e143f7dcecc1db22ae8b99c0804b76d173b9f76a618f89ee8d1d171
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-hPAi2-E5JMk6UZrEBm-Sjw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-hPAi2-E5JMk6UZrEBm-Sjw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
application/javascript; charset=utf-8
cache-control
private, max-age=1800
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Wed, 29 Nov 2023 15:43:07 GMT
usermatch
ssum-sec.casalemedia.com/ Frame 962C
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
240d99c3fe3eedbcd13cf69556ca791a8b8fd963a2d183c8a74ca4cea58272a9

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e64a5f01e7-ZRH
content-encoding
br
content-type
text/html
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rMItIqxQWhHkad7q0yhed8RUWAgu9hrIUr3nFUir6Lyw53G0YgKAT6zcE0aK4aeh4kijC62utnZEDe5ki6v3Rf24%2F1Wrw%2BTYlkwwaa1%2FoyiUO3QsjUOXxCPJJSWlcozaYNdJRWXli7JCqg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e5f9e501e7-ZRH
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
location
/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OpiEwAeZaQ7jtJ%2Bp9WqZHOyr9coYP5bSVGw29Z7aLfSOovZ1qpjzWS8zQ6eMeNNlDohXmn%2Ftku9xyQml5lPLkILqzsoQBHIXEzdk7s2DAhXmm2Jw0yk%2BADAZ%2FPNRYVnYdKeasSwtsR%2FNzg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 7A79
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
  • https://eus.rubiconproject.com/usync.html?p=12776
281 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=12776
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Wed, 29 Nov 2023 15:43:07 GMT
ETag
"280525-119-60930cbd3cec0"
Last-Modified
Thu, 02 Nov 2023 19:57:23 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
location
https://eus.rubiconproject.com/usync.html?p=12776
server
AkamaiGHost
sync
usr.undertone.com/userPixel/ Frame 0223
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=20e97b69-8983-47e8-91e3-9f94fbeabe97
0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=20e97b69-8983-47e8-91e3-9f94fbeabe97
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
BQt24n4IH84HZ8Jf6dbpkdJExytS1NcJM9aozS2yXoYsHSDrVRFfNQ==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=20e97b69-8983-47e8-91e3-9f94fbeabe97
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame 0223
Redirect Chain
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
0
193 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
FYIvW5uv03rI_OCnnd6L2x9mND-aJdc4qpg1F0QmH9DiCejSVUbhUg==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
generic
match.adsrvr.org/track/cmf/ Frame 0223 		70 B
149 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
sync
usr.undertone.com/userPixel/ Frame 0223
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTO1-1I-BB72
0
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTO1-1I-BB72
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
vpICDZ7Az-SPNPbr8uSv09DLdW3DY9W3sjDXq8zqjZLekQyleiNQ8Q==
x-cache
Miss from cloudfront

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTO1-1I-BB72
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
sync
usr.undertone.com/userPixel/ Frame 0223
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RTYzN0Y2QTYtNEQzMC00QjhFLUE3MzEtNThEMjg4MTE0NkQ3&gdpr=-1&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7B...
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
Hs3f9TBe6cnQMWbqYxT1twZ-hR_bwu63WRofsdBfN5guDCBptZ0oSQ==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
date
Wed, 29 Nov 2023 15:43:06 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
sync
usr.undertone.com/userPixel/ Frame 0223
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerI...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3Fpa...
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
0
317 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
oGjXxA-7DOyP20rP_f3kgi7MfdrIkosD5Yo56rbxcTsF3zBZfdcszg==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame 0223
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58545/occ
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
0
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
ui65d3jtCxfJIFisn8yR2XYE7vC5KuX3GHZdO2Vep9rOHy4C_zUpLQ==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
stdd231129_hd.xml
picayune.uclick.com/comics/stdd/data/ Frame C830 		902 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://picayune.uclick.com/comics/stdd/data/stdd231129_hd.xml
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.188 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
66de8327e8ba8313b51ce1152038d53d24bb3b0c6e4e6ef8a055d06f92b9ab2d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:07 GMT
Last-Modified
Wed, 29 Nov 2023 06:22:02 GMT
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/xml
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length
902
sync
usr.undertone.com/userPixel/ Frame F0CA
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=4985e05f-f2a9-4c40-9567-3ee80d931ab3
0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=4985e05f-f2a9-4c40-9567-3ee80d931ab3
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
eRnuBapc4h3amM-H2N8wmThEY5dPUYx8GBk7HPrOr7vHNT13cFQMaA==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=4985e05f-f2a9-4c40-9567-3ee80d931ab3
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame F0CA
Redirect Chain
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
0
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
0TT6nIoKNhH8JDHzIrKr1AadnEsq7mmUwXZFOZihK75TYYWB3CMbZA==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
generic
match.adsrvr.org/track/cmf/ Frame F0CA 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
sync
usr.undertone.com/userPixel/ Frame F0CA
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTO2-1K-L57O
0
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTO2-1K-L57O
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
aZyzlMPavyW0qaVifRCE-3V5Lu3QR8bCH7hQliFGees9BWxohH4wKA==
x-cache
Miss from cloudfront

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTO2-1K-L57O
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
sync
usr.undertone.com/userPixel/ Frame F0CA
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTEyNDNFODAtRTdBMy00NTk2LTg4QTEtNjNFNUVGNUMyMzJE&gdpr=-1&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7B...
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
mtrEpgTSKul7EiiKM1EpqilFKz4p_zAgFCt5SFRm7guxD09j-lD5aw==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
date
Wed, 29 Nov 2023 15:43:06 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
sync
usr.undertone.com/userPixel/ Frame F0CA
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerI...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3Fpa...
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
0
319 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
HOj-jLoV5RmRClDEYmZNLQE8PlW3X5pb06FaB-3Pbljp9WvQBVX6iw==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame F0CA
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58545/occ
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
0
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
fVJwWsIcYFGvtXKVipVvZcoST9KHGK80t-tum12sxtBwQwTKMVoQBA==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
usermatch
ssum-sec.casalemedia.com/ Frame F7A3
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
350da8937f5f118f9000e1ddf5b8913c9b50837dbdc4cc906487737aefc00a1e

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e64a6e01e7-ZRH
content-encoding
br
content-type
text/html
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=627hNB1nOhiAujiWgQYDl9ToLqb4kqLqTPUUA0RY44jCeT0xKceUDYTPmRRUvkhu%2B5qXUuA50m7d4nJTRaJYcmn%2Bqct9eMqBUIwnGOdK2JwSOLG4k1NznU%2Fp%2FJb4fa1dtIYeTnGvYgw8xQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e5f9e701e7-ZRH
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
location
/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1pEdNP6CpGydIOIZzHU1iAftQK2x79TeJ1KaRZZHrUjbHSOv2qVif3kHjRr8YmH%2BFWVyN51mj9UCnqlcLLHhg8r%2FiQ%2FQGvlf%2Fs7Np8TBridA%2FfGYILEp%2BLT69umq%2Bdu4fmqmzopnZe9kVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
  • https://eus.rubiconproject.com/usync.html?p=12776
281 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=12776
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Wed, 29 Nov 2023 15:43:07 GMT
ETag
"280525-119-60930cbd3cec0"
Last-Modified
Thu, 02 Nov 2023 19:57:23 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
location
https://eus.rubiconproject.com/usync.html?p=12776
server
AkamaiGHost
sync
usr.undertone.com/userPixel/ Frame D7D9
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=5c3095b4-3a34-41bb-a2ce-dc5a5c9a0c8a
0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=5c3095b4-3a34-41bb-a2ce-dc5a5c9a0c8a
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
mOcRjPVj6m888fbeL6A2ra3mD_RSPTWodjvwzqYwaFYuCI9il2DEtw==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=5c3095b4-3a34-41bb-a2ce-dc5a5c9a0c8a
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame D7D9
Redirect Chain
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
0
193 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
0OWNmiOQgVofzFQpvp25waeRvFxJlNAWjjNbIGdpe7QRq2_yZa67JA==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
generic
match.adsrvr.org/track/cmf/ Frame D7D9 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
sync
usr.undertone.com/userPixel/ Frame D7D9
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOC-Y-J8CK
0
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOC-Y-J8CK
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
Xs3ljXu7RU5BFbltoOBIiSKBPGdIhACzPA5TcIBPLQb2KfWq9lRoBg==
x-cache
Miss from cloudfront

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOC-Y-J8CK
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
sync
usr.undertone.com/userPixel/ Frame D7D9
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QkMzRTE5MDctQTlDMC00MTgyLThFQTktMEJGMDk5M0U1QTNF&gdpr=-1&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7B...
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
0
309 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
OzHShI7ZJWY58T4oKF-viyG-hL9PMY-LhEraK04u8xii7UeVRn_5fQ==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
date
Wed, 29 Nov 2023 15:43:06 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
sync
usr.undertone.com/userPixel/ Frame D7D9
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerI...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3Fpa...
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
0
319 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
ZfbmO2SPj4I5D5qvmFNSpbwHkzvB87kbQHB1mIXqE1mW2efhwHiWqg==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame D7D9
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58545/occ
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
0
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
XCrBqLPeGnBbMe_lL4KPAiFwTjUYKt5nSxrKmaFqxe0leHN3BRgf2w==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
usermatch
ssum-sec.casalemedia.com/ Frame A37D
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26e70825f3b5817e1c9d35f52aca6469927c6fcf549f18568becc7ddcb3a9dce

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e65a8c01e7-ZRH
content-encoding
br
content-type
text/html
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y1KULJf%2Fd3708m%2BuywAPYVkkqHHfh4BHwrIxo%2BJ%2FXEmDcFssCseoBtYDlqm3iBSPLWQHeTpoQAqqHtriP47YH916Zuv4g%2BQx2Bg2I4w%2F57sBMfch3C6UBkg6DZZfhCJMMCHupLvVqcG2Ew%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e5f9ed01e7-ZRH
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
location
/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d59H4xCxWWf9%2FsXYD9%2Fc9EBBs39qVG5K1qMv9KFrwhpHWYhz9lPOY0vAG9Lqsuh6wOo%2FPviyNWMgdBjNfHdgBcxmgOAS2XFMtEPiwP5l%2FthBiSLb%2B1VITSUpOxb2ad1LQdSWPr0Ngvsosw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
  • https://eus.rubiconproject.com/usync.html?p=12776
281 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=12776
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Wed, 29 Nov 2023 15:43:07 GMT
ETag
"280525-119-60930cbd3cec0"
Last-Modified
Thu, 02 Nov 2023 19:57:23 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
location
https://eus.rubiconproject.com/usync.html?p=12776
server
AkamaiGHost
sync
usr.undertone.com/userPixel/ Frame B612
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=20e97b69-8983-47e8-91e3-9f94fbeabe97
0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=20e97b69-8983-47e8-91e3-9f94fbeabe97
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
-x1dFKanyEjjpk0ITEJMk_gtmA_UW-c5ZFwD2aGFr1nWZ-kYDGaN5A==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=20e97b69-8983-47e8-91e3-9f94fbeabe97
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame B612
Redirect Chain
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
0
193 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
mhLP4pL4q4NhfdiR-cC-NTcNzrhaMXWZ_SatyPtI_77QiHUmWiCF6A==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
generic
match.adsrvr.org/track/cmf/ Frame B612 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
sync
usr.undertone.com/userPixel/ Frame B612
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOM-1F-L42F
0
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOM-1F-L42F
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
s_93UAT4dgdZ5fVivY3q1WRzOj-TIKAyUVYoF2NTWI0Yt-6OHNsLoA==
x-cache
Miss from cloudfront

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOM-1F-L42F
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
sync
usr.undertone.com/userPixel/ Frame B612
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MDZDNDQxNUYtMkJBQy00MjlGLTlEMDMtOERBODY3MzA4QTlC&gdpr=-1&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7B...
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
dVi60oGVsw19jPdSddCVcSr-1Fet5pMACUJPZ0lMSSbfaKKfzJe_Gw==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
date
Wed, 29 Nov 2023 15:43:06 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
sync
usr.undertone.com/userPixel/ Frame B612
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerI...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3Fpa...
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
0
318 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
v3SbzpgoLwA1BbK6gdCHG0qVs-BcwNATAoTD3LRP9Ld8BY_WdshDiQ==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame B612
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58545/occ
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-yyvHb7FE2uHD9V7Z7qO_e9LB_bkQhg5NSChsZN8-~A
0
318 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-yyvHb7FE2uHD9V7Z7qO_e9LB_bkQhg5NSChsZN8-~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
uhf-SG-jyoNR-rrFBOjlZD2aziMrJ-Ytg2lZkP9Gc1WaZsIHtdXX6Q==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-yyvHb7FE2uHD9V7Z7qO_e9LB_bkQhg5NSChsZN8-~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
usermatch
ssum-sec.casalemedia.com/ Frame 3E0B
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
2 KB
874 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f500275ef2463ebe4b152fb0fc473ac0c71005b30af849cac060882c63b485e

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e66ab001e7-ZRH
content-encoding
br
content-type
text/html
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kgODPF25bg2o0jM1eLe7GDEzN84z3%2Fk6IIf2LxGDGppfQVrLF4mbY8Tgd7LWNmISxZudPy%2BlsvOhvBsvtD%2B%2FPS%2B%2FCtdm8Ey8VGzwC6OugL5qOf79n4DSbBaIS6LkoUgft3EfuWgM4ahJKA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e5f9ea01e7-ZRH
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
location
/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T8SL6fogU9Yrr5HJAbaRf5oknRDUd%2BWBFjkrMwICLaau0bxvtFeMNIVFifGbKR%2FF7Xu%2FrGnYKafhL8ZIVsxZ4Js5r1Evum0NCN%2B1JjaIl8djdnejxvTcjtwtg87srCvfvubV9b2q6huENg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 6492
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
  • https://eus.rubiconproject.com/usync.html?p=12776
281 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=12776
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Wed, 29 Nov 2023 15:43:07 GMT
ETag
"280525-119-60930cbd3cec0"
Last-Modified
Thu, 02 Nov 2023 19:57:23 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
location
https://eus.rubiconproject.com/usync.html?p=12776
server
AkamaiGHost
sync
usr.undertone.com/userPixel/ Frame 2FC4
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
  • https://usr.undertone.com/userPixel/sync?partnerId=39&uid=f258318d-56c5-4dae-b3a1-fbd90b93292b
0
309 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=f258318d-56c5-4dae-b3a1-fbd90b93292b
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
B2zbsBfDd-wcjYQ2GzBR7eek8F6hMcnHZ0RLXzsRwvhXZacTYDFvqA==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=f258318d-56c5-4dae-b3a1-fbd90b93292b
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame 2FC4
Redirect Chain
  • https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
  • https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
0
192 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
8Vr-Xz81H2Ixpcojf9XQLN1kxQD5Fq1anBi50XdnD6rnxaoya6pkCQ==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-uKPOyytE2uFo.6vS5lYtm6GRLy.QV_CT~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
generic
match.adsrvr.org/track/cmf/ Frame 2FC4 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
sync
usr.undertone.com/userPixel/ Frame 2FC4
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
0
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
Bm09gVuNQvPnN74cn_69fOSoLWmbCVWeuye8lG9NHUDpAwcP566xfQ==
x-cache
Miss from cloudfront

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
sync
usr.undertone.com/userPixel/ Frame 2FC4
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Qjk5QzA0MjItNTI4Qi00RjU5LUE3QUEtQkQ0NDA0Qzk0QzQ0&gdpr=-1&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3DB99C0422-528B-4F59-A7AA-BD4404C94C44&us_privacy=%24%7B...
  • https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
0
309 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
B7UIZdM97xhkGzuT7rtrGtMpdJ4PHh2Aq577DWxGhdctGVPIL992eQ==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=B99C0422-528B-4F59-A7AA-BD4404C94C44
date
Wed, 29 Nov 2023 15:43:06 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
sync
usr.undertone.com/userPixel/ Frame 2FC4
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerI...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&partner_url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3Fpa...
  • https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
0
319 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
Rgv6FcDGcrzsSZUHxQi6OzkIqtMmKkyfLpLohhcCw_S7XOqL0lNLZQ==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://usr.undertone.com/userPixel/sync?partnerId=54&uid=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
usr.undertone.com/userPixel/ Frame 2FC4
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58545/occ
  • https://ups.analytics.yahoo.com/ups/58545/occ?verify=true
  • https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
0
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cdn.undertone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
MjWYg6YKKXWt8LSSbWfTjq-JaOQ_i210S010d9n2Fqai6-GfsezT5A==
x-cache
Miss from cloudfront

Redirect headers

location
https://usr.undertone.com/userPixel/sync?partnerId=56&uid=y-AkvwbRBE2uEypPA022dOuhieH79c30DU784ct.E-~A
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
usermatch
ssum-sec.casalemedia.com/ Frame 8216
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=197137&cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
2 KB
802 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1fa523e81d755c257b9653e3554d7ae6acf52ef5f24d5c95aa1b772aad455f68

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e66aa001e7-ZRH
content-encoding
br
content-type
text/html
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s50isrXQD18UfeXRoH%2BDs%2BVhpTztHV0SOZnt30WTDNVtfUhFmPfvdrsjYo7L%2BR1H9FHJdIQJ6JU4uU0dsBZVyrHb9ukHmTPau7ZX93ZgOYm4ROUcZXAsiw%2FpQYgaivNaIf38hIwDTE5uOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
82dbf6e5f9ec01e7-ZRH
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
0
location
/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GFuYWshvVwkc2b3tdxEXbgUFEmvuV%2Fe7iWuHfJqZuW0cMr7I2dCXqzchRTVVnjygW2zU6EaJqMxrQjJQ1LEhK4w%2FZCLmfFtXDZ3%2F%2Bm7sNQm0xuHytdoVciiUJh5VilAj0exPu%2B51DoQLaA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 31D5
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
  • https://eus.rubiconproject.com/usync.html?p=12776
281 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=12776
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://cdn.undertone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Wed, 29 Nov 2023 15:43:07 GMT
ETag
"280525-119-60930cbd3cec0"
Last-Modified
Thu, 02 Nov 2023 19:57:23 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Wed, 29 Nov 2023 15:43:07 GMT
location
https://eus.rubiconproject.com/usync.html?p=12776
server
AkamaiGHost
eventjson
events.iwin.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://events.iwin.com/eventjson
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.85.57.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-85-57-117.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://securegames.iwin.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
false
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
*
access-control-max-age
86400
content-type
text/plain
date
Wed, 29 Nov 2023 15:43:07 GMT
eventjson
events.iwin.com/ Frame 980F 		0
235 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://events.iwin.com/eventjson
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/console/v_313/site-console/js/main.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.85.57.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-85-57-117.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://securegames.iwin.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

access-control-allow-origin
*
date
Wed, 29 Nov 2023 15:43:07 GMT
access-control-allow-credentials
false
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/plain
list
cs.minutemedia-prebid.com/ Frame 5B53 		825 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cs.minutemedia-prebid.com/list?cb=__SRCsSC97928488&org=6475aa705b23100001019b46&tc=6475aaf65fe06700018e50d8&as=6475aaf65fe06700018e50da&type=hb&wd=cs.minutemedia-prebid.com&domain=theepochtimes.com
Requested by
Host: sdk.minutemedia-prebid.com
URL: https://sdk.minutemedia-prebid.com/cs-config/cs.html?org=6475aa705b23100001019b46&tc=6475aaf65fe06700018e50d8&as=6475aaf65fe06700018e50da&type=hb&wd=cs.minutemedia-prebid.com&domain=theepochtimes.com
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
18.200.44.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-44-133.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
273995351e70c08e82fa829bc8c06a871d3809f00c3b7dbc0633278ba194a9f6

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://sdk.minutemedia-prebid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://sdk.minutemedia-prebid.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
5
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
825
stdd231129_hd.jpg
picayune.uclick.com/comics/stdd/images/ Frame C830 		251 KB
252 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://picayune.uclick.com/comics/stdd/images/stdd231129_hd.jpg
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
66.6.101.188 Waverly, United States, ASN11320 (LIGHTEDGE-AS-02, US),
Reverse DNS
Software
/
Resource Hash
9679406bfb3bdcbd74652282dd7257f1325ce1ed069d80e3cba9244ba1919dca

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:06 GMT
Last-Modified
Wed, 29 Nov 2023 06:20:01 GMT
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length
257266
style
accounts.google.com/gsi/ Frame 980F 		533 B
585 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/style
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-gXcVn4CeIICB-zYUI_TF1A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://securegames.iwin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-gXcVn4CeIICB-zYUI_TF1A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
text/css; charset=utf-8
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Wed, 29 Nov 2023 15:43:07 GMT
button
accounts.google.com/gsi/ Frame C50E 		114 KB
41 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/button?type=icon&shape=square&theme=outline&text=signin_with&size=small&client_id=238531725567-d93kvm0isfq740t15a0btdc3m4gq8lif.apps.googleusercontent.com&iframe_id=gsi_587291_690295&as=f2yarsxrRZ2lMXqrXDu8oQ
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
78906df37ee46e962f38eb80c613c2cc179c19dc91aed4004c342eec593b5933
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http script-src 'report-sample' 'nonce-g0WV_RZNe3MP1NKJtAc1Dg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securegames.iwin.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http script-src 'report-sample' 'nonce-g0WV_RZNe3MP1NKJtAc1Dg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
cross-origin-resource-policy
same-site
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options
nosniff
x-xss-protection
0
button
accounts.google.com/gsi/ Frame 2349 		114 KB
41 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/button?type=standard&shape=rectangular&theme=outline&text=signin_with&size=small&logo_alignment=left&client_id=238531725567-d93kvm0isfq740t15a0btdc3m4gq8lif.apps.googleusercontent.com&iframe_id=gsi_587304_198312&as=f2yarsxrRZ2lMXqrXDu8oQ
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7924847f88e388d4bf7f6c53a98cccfd3acf3cb68632440b3d154caf264170c7
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-kuexQ-WTVd0M9FlCwVCH_w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securegames.iwin.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-kuexQ-WTVd0M9FlCwVCH_w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
cross-origin-resource-policy
same-site
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options
nosniff
x-xss-protection
0
button
accounts.google.com/gsi/ Frame 8E39 		114 KB
41 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/button?type=icon&shape=square&theme=outline&text=signin_with&size=small&client_id=238531725567-d93kvm0isfq740t15a0btdc3m4gq8lif.apps.googleusercontent.com&iframe_id=gsi_587305_413926&as=f2yarsxrRZ2lMXqrXDu8oQ
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e9a6c12c8ff448789eb1d44e1b3e9983321d5724de40bf191157188ba255a513
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http script-src 'report-sample' 'nonce-mE_DAMQn0BX-HgMA6qidGw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securegames.iwin.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http script-src 'report-sample' 'nonce-mE_DAMQn0BX-HgMA6qidGw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
cross-origin-resource-policy
same-site
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options
nosniff
x-xss-protection
0
button
accounts.google.com/gsi/ Frame F378 		114 KB
41 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/button?type=icon&shape=square&theme=outline&text=signin_with&size=small&client_id=238531725567-d93kvm0isfq740t15a0btdc3m4gq8lif.apps.googleusercontent.com&iframe_id=gsi_587306_189314&as=f2yarsxrRZ2lMXqrXDu8oQ
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e7f75abb89b10512d3b66dd62ad6df27f2793e338c12c3e415b60caba891f364
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http script-src 'report-sample' 'nonce-ryh2sN9sU8Woc-sRapHWOw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securegames.iwin.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http script-src 'report-sample' 'nonce-ryh2sN9sU8Woc-sRapHWOw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
cross-origin-resource-policy
same-site
date
Wed, 29 Nov 2023 15:43:07 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options
nosniff
x-xss-protection
0
crum
dsum-sec.casalemedia.com/ Frame 962C
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcC14uS3.iD3DAYpf7EwAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1&google_hm=2
43 B
736 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1&google_hm=2
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jUqNxU45BsZNOAXf5oLBXIT8Ab7km%2BW2c5RA9v92qSzk9a%2BUpFI34jQwEeVOQpytosHJUR5mpYRRRyFClQQLsDkrAekmzkPAAs9v%2BFWV9FQ8iKGzIlLX%2FIimvq%2FXe1899cot9%2BipUuugVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e7bf7c01f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1&google_hm=2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
330
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
casale
match.adsrvr.org/track/cmf/ Frame 962C 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
28292
i6.liadm.com/s/ Frame 962C
Redirect Chain
  • https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZWdcCxphSIpZvWf7y-DLDgAA%265285&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
  • https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZWdcCxphSIpZvWf7y-DLDgAA%265285&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=722f175b673640ec93b4fd134ef576e0
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
HTTP/1.1
Server
2600:1f18:ed:550a:3539:381b:7999:2df1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:08 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
9
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Date
Wed, 29 Nov 2023 15:43:08 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
2
dcm
s.amazon-adsystem.com/ Frame 962C
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCxphSIpZvWf7y_DLDgAAFKUAAAIB&gpp=&gpp_sid=
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCxphSIpZvWf7y_DLDgAAFKUAAAIB&gpp=&gpp_sid=&dcc=t
43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCxphSIpZvWf7y_DLDgAAFKUAAAIB&gpp=&gpp_sid=&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
HTTP/1.1
Server
52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
R30FHDA1PYH5B1EBM2WF
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
H1WSS89WA1WEMBQFYPXX
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCxphSIpZvWf7y_DLDgAAFKUAAAIB&gpp=&gpp_sid=&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
bridge
cm.adgrx.com/ Frame 962C 		43 B
283 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.adgrx.com/bridge?AG_PID=casale&AG_SETCOOKIE
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.251.241.196 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
Cowboy /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
Cowboy
content-type
image/gif
p3p
CP="NOI OTC OTP OUR NOR"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, proxy-revalidate
x-realserver-nx
ams-delivery-5
content-length
43
expires
Thu, 23 Sep 2004 17:42:04 GMT
crum
dsum-sec.casalemedia.com/ Frame 962C
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=2079
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5107433831282994715
43 B
734 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5107433831282994715
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XeCqA4qeTotzbzkVLzwitpO28ifWGlX%2Buq6HRGQwEbbKjl%2BV99b96VwWPLkoknRB%2FTtx0bf5ioh1Qy%2BfadoeFwiWzdEtIzPTMEq%2FlZC3mwpFrKlLkMr4iOjXifnrvJPyiM95d63NgBN6pw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e8080701f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5107433831282994715
Date
Wed, 29 Nov 2023 15:43:07 GMT
Server
Jetty(9.4.51.v20230217)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
crum
dsum-sec.casalemedia.com/ Frame 962C
Redirect Chain
  • https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
43 B
734 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hhyagpuG8hw7UTXyK6sOdjNRiD2bCTAZ2CVrkvIkODTRotYLqdq1GsRTfpkGLyJ2%2FDTToLv1oVdasY8wGz%2FRjbXGVbyCO7XVyeUzGan7U2t%2BjbVA4EoZaSrnm1kIiv5mKUmNxYX%2FNjEsXg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6ea2bcb01f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
95
Content-Type
text/html; charset=utf-8
crum
dsum-sec.casalemedia.com/ Frame 962C
Redirect Chain
  • https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1716997387&external_user_id=75608216-8d33-459b-8783-54e4d5df9632
43 B
731 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1716997387&external_user_id=75608216-8d33-459b-8783-54e4d5df9632
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LrfhES6B77XA%2B1Xyd15LLiHth%2F9iHRWu19IFVJ%2FqQfY7dUvrAClpV1BIA0wm8JehXcTKQ92tKdNXa4NnbrOptKNhyyMLeKZPCf1yPXeaky9cHIu3JUrbarU3Wi4EkpmdGdBR7xXPqlYe8g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e8080201f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 google
access-control-allow-methods
GET,OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*.casalemedia.com
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1716997387&external_user_id=75608216-8d33-459b-8783-54e4d5df9632
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
157
sync
usr.undertone.com/userPixel/ Frame 962C 		0
310 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=57&uid=ZWdcCxphSIpZvWf7y_DLDgAAFKUAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
NiYY5_ggXogmdqCz8GTZRduDxZQvZzCbPloJuyV7nCAqyJyIQpCRXA==
x-cache
Miss from cloudfront
casale
match.adsrvr.org/track/cmf/ Frame F7A3 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
crum
dsum-sec.casalemedia.com/ Frame F7A3
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcCwgujNemO8dxf6yPZgAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
43 B
731 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OBlxFvDqdQeYzRvzoHXelxMHSzcXiLoVUWNjO%2BpgBeYxY3OMJXIKPNZDdMjxY1pumRizgG7AB0chmRqZRpmMZfKm8ScDaa%2BwX90mbkcrfoazr3xPrfniNTiLjkfltpfPdOy9Tnj9stNm4g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e77f1801f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usermatchredir
ssum-sec.casalemedia.com/ Frame F7A3
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZWdcC14uS3-iD3DAYpf7EwAACHQAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
43 B
738 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CZS3zKlTO%2FEk0PQ6oUHHsaovCr4b%2BVLCEm3pu8IqcfZ6suBAlC%2BWzZ7SsklSNwDcvTWTdrTQZ4NsE5iTnyCOWGneA6UMXcazH%2FXT%2FNCejOA2ch37xKhx9pbo%2B7F0%2B0pv7hfJmbulRHhQwg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e7bf7801f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
364
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
28292
i6.liadm.com/s/ Frame F7A3
Redirect Chain
  • https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZWdcC14uS3.iD3DAYpf7EwAA%262164&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
  • https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZWdcC14uS3.iD3DAYpf7EwAA%262164&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=9f15a3c8a7c744fa8e1632cdc7c60e98
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
HTTP/1.1
Server
2600:1f18:ed:550a:3539:381b:7999:2df1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:08 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
0
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Date
Wed, 29 Nov 2023 15:43:08 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
2
crum
dsum-sec.casalemedia.com/ Frame F7A3
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8325801272123076523&gdpr=0&gdpr_consent=
43 B
729 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8325801272123076523&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t7YJsTjbD5UzWqt%2FO6kCBkhVMY0KhVrweRFKX4eq69XSDxUNoBXyeoi705bQ5vFPjSzuUWfqJkq6mXiY0SjpFJ7QrqnmaGiKnnVgt0c9BovcwFtibRcGIOzWUmoTBsmqyuKaOV2mhzULlg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e8182701f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8325801272123076523&gdpr=0&gdpr_consent=
date
Wed, 29 Nov 2023 15:43:07 GMT
content-length
0
rum
dsum-sec.casalemedia.com/ Frame F7A3
Redirect Chain
  • https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=jOtXCY-9UVyX6FAOjrtMWtznWAqXvFMP2OmaheWc
43 B
764 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=jOtXCY-9UVyX6FAOjrtMWtznWAqXvFMP2OmaheWc
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mDzXTKskAfOxkEtDhjrANqHip3FMAvLM23okCPN6tD%2Brf0LMt0MNGD14e4bxhNjJeXoMsV367efI3dwDghTWPnuwHwXjAWa9rCgfWoUdMocVbIYmYSKnXoHzOOVJKs9LJt4gDvdEl7Vs2g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e76ef601f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=jOtXCY-9UVyX6FAOjrtMWtznWAqXvFMP2OmaheWc
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame F7A3
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=ZWdcCwADQpy1QABU
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZWdcCwADQpy1QABU&_test=ZWdcCwADQpy1QABU
43 B
737 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZWdcCwADQpy1QABU&_test=ZWdcCwADQpy1QABU
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bsI4%2F%2FaKfdUODna2N9gS03lTaWe94IgX6CmW%2FtXvGvBqSJBc06IMaZG136uDVQfO8Q%2FjTJObaqoD%2B6L1syc0197rscVxl1Xz9hRJYlh1vQTH0%2BwqXsP1F%2Fx8mRfH%2FqaF40TD7gGOWBt0rQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e8587b01f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

x-served-by
cache-mxp6937-MXP
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 varnish
server
Varnish
x-timer
S1701272588.535921,VS0,VE0
x-cache
HIT
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZWdcCwADQpy1QABU&_test=ZWdcCwADQpy1QABU
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
crum
dsum-sec.casalemedia.com/ Frame F7A3
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=oDjxqhXq1R8mIr5
43 B
734 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=oDjxqhXq1R8mIr5
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9iVyt07Cv6RidTP%2BGO6iFUeA82lpqvyyzEGwD4bG5Zd9T0sq2504rE60Z4E0g%2Fmm642bYfgCisHhbBTkGjAWR18YOZu%2BW3RnlgT1j6Gf%2BuVWtDNhCh8toepdwYsJ8AaruJgFhfxz%2B1w%2FVA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e8080401f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:06 GMT
Strict-Transport-Security
max-age=2592000; includeSubDomains
Server
PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-091a6d662d9a132c7@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=oDjxqhXq1R8mIr5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
usr.undertone.com/userPixel/ Frame F7A3 		0
307 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=57&uid=ZWdcC14uS3-iD3DAYpf7EwAACHQAAAAB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
aS0fxiJ3LbIxqbTeaGRIb3AyCh71ZCt4FilPkhZ6bAdCmdSwNHWaYg==
x-cache
Miss from cloudfront
usermatchredir
ssum-sec.casalemedia.com/ Frame 8216
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZWdcCyJJNKYq5stdvyoBHQAADP8AAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
43 B
736 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IJuNk%2FMFaHC5HG5FoxrhyGISxR5qhMq0Fm0K5l4hA7wMvhwfdXDt8ZEvCAdfsVGWmlNhGYBFUqV1IrQCx%2FVRDFW%2FK6VxSCseF5o7pzcU0kFfPlkiETTHNYCfbhjERBfu%2Bek9%2BIS0iezO5g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e7bf7401f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
364
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
28292
i6.liadm.com/s/ Frame 8216
Redirect Chain
  • https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZWdcCyJJNKYq5stdvyoBHQAA%263327&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
  • https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZWdcCyJJNKYq5stdvyoBHQAA%263327&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=2ee7e4fa4e994c268a6bf9ac3f8e0eed
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
HTTP/1.1
Server
2600:1f18:ed:550a:3539:381b:7999:2df1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:08 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
0
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Date
Wed, 29 Nov 2023 15:43:08 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
2
crum
dsum-sec.casalemedia.com/ Frame 8216
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcC-sXacToKX2bjE7h3AAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
43 B
736 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ojO9OQeBhDQkXqtd%2BhsZ3YbHHfgZT9MdRgBb6YZsmx7ktfnPyc3nxZz6kLQ7AO62abqAHXhWMq2tXPS9nQgWzMKfKu4%2FX5SxLeoS5%2FmnRz%2B2rjpfTwXKLrqQLEPPa6Bz%2F9D4jykA8GIExA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e78f2801f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
casale
match.adsrvr.org/track/cmf/ Frame 8216 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
rum
dsum-sec.casalemedia.com/ Frame 8216
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=68
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
43 B
733 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3BQ5Qsw5RrYSEG4ZMMknVWJta4aF8lr8SNknwrqTcRAaDmZVqh07GyIqo4MbH1i2Q1DXyQJO7iMSAyAcT31lcAmC1XhZTlyp1xxf4q%2Fpe7lZA9e0AIqFkWJPjtqC5cP%2F132j%2BxKAmPKW%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e9cb0a01f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
Date
Wed, 29 Nov 2023 15:43:07 GMT
Connection
keep-alive
Content-Length
122
Content-Type
text/html; charset=utf-8
ix
ad4m.at/ad/sim/ Frame 8216 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad4m.at/ad/sim/ix
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
rum
r.casalemedia.com/ Frame 8216
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
  • https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=
43 B
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SYHiu1Kmr2Gt%2BW2Sv7su3FiF%2BVoLm7eYsTubwV%2FS687UsNJxLmWxiG4SGBmkUF6%2F4VNkj6qDvuBAOBsGJWF07YHhOOvjQFZ9SSNjdMnaoQuPUkKVVrTbtU%2BEXHfvRtrfPQJS"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e71bf201e7-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
A
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
tp_out
d.adroll.com/cm/index/ Frame 8216 		42 B
181 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:cc3:fe04:3684:ac58:ec44:5836 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
cache-control
no-transform,public,max-age=300,s-maxage=900
server
nginx/1.22.1
content-length
42
vary
Cookie
content-type
image/gif
sync
usr.undertone.com/userPixel/ Frame 8216 		0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=57&uid=ZWdcCyJJNKYq5stdvyoBHQAADP8AAAAB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
rpbH7FfMAOoYF2MPXRWwkR2EaCcINNkUVXTsZsx0Omskcl_iYAesHQ==
x-cache
Miss from cloudfront
casale
match.adsrvr.org/track/cmf/ Frame A37D 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
dcm
s.amazon-adsystem.com/ Frame A37D
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCwgujNemO8dxf6yPZgAAFE0AAAIB&gpp=&gpp_sid=
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCwgujNemO8dxf6yPZgAAFE0AAAIB&gpp=&gpp_sid=&dcc=t
43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCwgujNemO8dxf6yPZgAAFE0AAAIB&gpp=&gpp_sid=&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
HTTP/1.1
Server
52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
HXMRJN1CVKRZKYTB76A2
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
3SWDS8QYDBP73B1YMRPE
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcCwgujNemO8dxf6yPZgAAFE0AAAIB&gpp=&gpp_sid=&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame A37D
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcC-sXacToKX2bjE7h3AAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
43 B
731 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QWjMIGp0E23u3X2E8CNBe7XU8WN90tgOE5wL%2FkLDWZp8rqHYZdUXDXoSB1cRbZSstamUjtRon6R8osaUJWlKcwHAbXqMoiEkJjnYvPkY0fEQpNm2m7Vt8hlKEgpVty%2FK0ZcBjdfZ1dHCww%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e78f2901f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usermatchredir
ssum-sec.casalemedia.com/ Frame A37D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZWdcCwgujNemO8dxf6yPZgAAFE0AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
43 B
732 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LgUFzZlRwFnXUb1PFEfB8%2BdztvdXfLfW6gDAltiW6tf%2F271cEz0Ht%2BN7kVD8LU3AMxXRVSoXygipKppbT8KS0v4g9AVddhi4nsoMTqBG9aCNElyjpeAorMc2QV%2FYcY7FejWkK1zc83nO8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e77f1701f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
364
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame A37D
Redirect Chain
  • https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=261f5beb-0718-478a-9ff7-4afd0eca556a&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
43 B
735 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=261f5beb-0718-478a-9ff7-4afd0eca556a&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MRKqP%2BIny%2FdKobx%2BIy3vPKWfzxaNEoCqQSUq8dF1mW20%2F4YP4z0fivFTTYzCJVw7ZOX5XGan94OwRGgiDajBgBppCV9vto5YpiaKUbYXc4AqFOrh7rEcZIJEUGzY4HlN1SrNcN5dVdUQYA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e78f3001f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=261f5beb-0718-478a-9ff7-4afd0eca556a&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
date
Wed, 29 Nov 2023 15:43:07 GMT
server
_
content-length
0
crum
dsum-sec.casalemedia.com/ Frame A37D
Redirect Chain
  • https://match.adsby.bidtheatre.com/indexmatch?gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcCwgujNemO8dxf6yPZgAA%265197
  • https://dsum-sec.casalemedia.com/crum?gdpr=&gdpr_consent=&cm_dsp_id=226&external_user_id=bf9086ab-e8ba-45bb-90be-499af4372459
43 B
730 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?gdpr=&gdpr_consent=&cm_dsp_id=226&external_user_id=bf9086ab-e8ba-45bb-90be-499af4372459
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SEDMHRgfCpqIbmYWKSrPrKYVgmjVXpGlLtTrV44JBzJlZloUP4kaMU4hWuCxH5gMeIx8pOUF6vv3wFhL5NKv06Gn0MRHy6S04RQHAyxPmveYjmxEh5n5EuuwTvTwAPxSjYTvtXAv7CU5JQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e77f1c01f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?gdpr=&gdpr_consent=&cm_dsp_id=226&external_user_id=bf9086ab-e8ba-45bb-90be-499af4372459
Date
Wed, 29 Nov 2023 15:43:07 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
rum
dsum-sec.casalemedia.com/ Frame A37D
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=68
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
43 B
730 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hUZN08QPaoat4213RtS0d22S%2BKtol51Gg2WJ3VvZaUyrCvH8wmGaNHoRg3BM5onqYz9fVhnL9lsO%2BgYwtqlxvPOlHChUcmnZmouaBX2QEwIFiKPr1Ew5iDYJSn%2FfQtfc8x5ZotIN5tUOzw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e9cb0801f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
Date
Wed, 29 Nov 2023 15:43:07 GMT
Connection
keep-alive
Content-Length
122
Content-Type
text/html; charset=utf-8
crum
dsum-sec.casalemedia.com/ Frame A37D
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=oDjxqhXq1R8mIr5
43 B
739 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=oDjxqhXq1R8mIr5
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LSSmxNqnjug403dzyAQ4qGBOMSyCHOZvI%2FmfqACEhEVT95ITcq2AdIG9xXBYCxQEXd4W%2BeW%2F60xBZWQtY9YskUcvB4SnZ7Id%2FF%2B8CZ2ITVVcw4Oqr7DvWvBfGatabJ%2BjE2GZDuGjoEz36g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e8080501f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Strict-Transport-Security
max-age=2592000; includeSubDomains
Server
PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-006fa252bd7417634@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=oDjxqhXq1R8mIr5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
usr.undertone.com/userPixel/ Frame A37D 		0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=57&uid=ZWdcCwgujNemO8dxf6yPZgAAFE0AAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
5ReC-4kASWfxraPKuGuwl0HNk73MhjHHz0Zd77ouABAnz6LG1ftsIA==
x-cache
Miss from cloudfront
j
rp4.liadm.com/
Redirect Chain
  • https://rp.liadm.com/j?dtstmp=1701272587322&se=e30&duid=57b4458eb59c--01hgdvz2xx52zhtpkasf60wjrm&tna=v2.11.1&pu=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&wp...
  • https://rp4.liadm.com/j?se=e30&duid=57b4458eb59c--01hgdvz2xx52zhtpkasf60wjrm&tna=v2.11.1&dtstmp=1701272587322&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-di...
13 B
318 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://rp4.liadm.com/j?se=e30&duid=57b4458eb59c--01hgdvz2xx52zhtpkasf60wjrm&tna=v2.11.1&dtstmp=1701272587322&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&i6=MmEwNTphZDAwOmI6MDoxMjU6OjE%3D
Protocol
H2
Server
35.168.179.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-179-116.compute-1.amazonaws.com
Software
/
Resource Hash
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
x-pixel-event-id
c58d806b-d172-4814-b163-7d0f356d6f51
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
null
access-control-expose-headers
*
access-control-allow-credentials
true
content-length
13

Redirect headers

location
https://rp4.liadm.com/j?se=e30&duid=57b4458eb59c--01hgdvz2xx52zhtpkasf60wjrm&tna=v2.11.1&dtstmp=1701272587322&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&i6=MmEwNTphZDAwOmI6MDoxMjU6OjE%3D
access-control-allow-origin
https://www.theepochtimes.com
date
Wed, 29 Nov 2023 15:43:07 GMT
access-control-expose-headers
*
access-control-allow-credentials
true
content-length
0
access-control-allow-methods
GET
usermatchredir
ssum-sec.casalemedia.com/ Frame 3E0B
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZWdcC_sXacToKX2bjE7h3AAAFLQAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
43 B
731 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xgaFK4%2BeOpBMF1m7lGAKRhU2my%2BHwsLoDYuXH5bvrBjvpz1a9H0h8ToM%2BAqpxyWqH6z5mY0PhEi0LAmFmTpk1e7IvFOXf856bqOYnsBPY9xOcptFGiBZ0gTyjm8YU6qWdUoU7QcpHgm8fQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e77f1a01f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFnTaYqEHGbRg02huKRiRsA&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
364
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 3E0B
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWdcC-sXacToKX2bjE7h3AAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
43 B
736 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NJCcKvVtO0ycMZQ188X0KD6%2F3MrJSyKMkY1cTsE%2F0VGnnRWDXVKzBBZHPcTYwy2OpdlSqHB6BR0mrUzbz5D7dOicdRWxwd4uQwJw2H%2B39LKsB7kLEO8bdhwXs8mMVXk4HOoRCWbhs%2Bc%2BMg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e7af6401f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFYgRLa8jFFk_Ye7MeQYiC4&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
28292
i6.liadm.com/s/ Frame 3E0B
Redirect Chain
  • https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZWdcC-sXacToKX2bjE7h3AAA%265300&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
  • https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZWdcC-sXacToKX2bjE7h3AAA%265300&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=f08cbe7d17b34a069150cbe9bbf902e2
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
HTTP/1.1
Server
2600:1f18:ed:550a:3539:381b:7999:2df1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:08 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
0
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-IyWaC443NU62hQE21zjrk3OAqU6U5cwitkAb8g
Date
Wed, 29 Nov 2023 15:43:08 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
2
dcm
s.amazon-adsystem.com/ Frame 3E0B
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcC_sXacToKX2bjE7h3AAAFLQAAAIB&gpp=&gpp_sid=
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcC_sXacToKX2bjE7h3AAAFLQAAAIB&gpp=&gpp_sid=&dcc=t
43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcC_sXacToKX2bjE7h3AAAFLQAAAIB&gpp=&gpp_sid=&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
HTTP/1.1
Server
52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
BVQKFZ3K944DEYNAYT4Z
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
7WXQZV6YC6RHSPV47RWS
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWdcC_sXacToKX2bjE7h3AAAFLQAAAIB&gpp=&gpp_sid=&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
usersyncsupply
cm-supply-web.gammaplatform.com/adx/ Frame 3E0B 		0
0
crum
dsum-sec.casalemedia.com/ Frame 3E0B
Redirect Chain
  • https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
43 B
734 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tf9LE5BBt0oCuoQvplFuPvCbbz%2BP3wW0STIe%2Ft9XYEZdksG9xK6dbWof5D1AoqPBPgW64DN%2BF95DT7PyDczeGu%2FADq5eXw0zbzqUwCotI2ID1wY2euL8Yv3YMIvlocOZ4C6OZS4XTWyytQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6ea2bda01f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
95
Content-Type
text/html; charset=utf-8
rum
dsum-sec.casalemedia.com/ Frame 3E0B
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=68
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
43 B
726 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oefupxiyl5yt7tgkmDksfwignGd29iiCn4KuMOARa150%2BRtvn1zQb1mDAOPAnAUTmxawW10NvHuepRZ3SN5CcHMkS2BxmxlAHsIMoPvgHwbxf6tOKK26iOmof7X0v9AzErYDoeLGmh2dEw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e9cb0b01f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Ol13Km9rW5N_haph2upMcrnDR9k
Date
Wed, 29 Nov 2023 15:43:07 GMT
Connection
keep-alive
Content-Length
122
Content-Type
text/html; charset=utf-8
crum
dsum-sec.casalemedia.com/ Frame 3E0B
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcC-sXacToKX2bjE7h3AAA%265300
  • https://creativecdn.com/cm-notify?pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcC-sXacToKX2bjE7h3AAA%265300&tc=1
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=ZrEOATwDRZeH2qy9kwJoIfG3y9rXUKsCHuV6WSFm9hI&pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcC-sXacToKX2bjE7h3AAA%265300&tc=1
43 B
738 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=ZrEOATwDRZeH2qy9kwJoIfG3y9rXUKsCHuV6WSFm9hI&pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcC-sXacToKX2bjE7h3AAA%265300&tc=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gzRRu7Hs6fM1jA6HAwzt6boiRHloqAxC%2FMLlvCuuwsvV87xQQJQUdQ9cZGn%2F8Zk1RFXuYIaodLkYqAhmDYW%2F8A%2BywWaM%2BEsxmlSGwZ3CSBCWlSI%2FvS8qdy4%2BH6NthAImJyhtt9iSytiG2g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82dbf6e7bf9301f0-ZRH
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=ZrEOATwDRZeH2qy9kwJoIfG3y9rXUKsCHuV6WSFm9hI&pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZWdcC-sXacToKX2bjE7h3AAA%265300&tc=1
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT, Wed, 29 Nov 2023 15:43:07 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
usr.undertone.com/userPixel/ Frame 3E0B 		0
307 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partnerId=57&uid=ZWdcC_sXacToKX2bjE7h3AAAFLQAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
ot55yR3zNTgz1d_H5b5p4wycbX6_bFZAVSQuKiY3orKPQUaHJxJhYQ==
x-cache
Miss from cloudfront
usync.js
eus.rubiconproject.com/ Frame 8C0D 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
d30ebe5017ee0a99c84556e36d105000a7352a72b16bdd457a813ff75197ce46

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=12776
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:07 GMT
Content-Encoding
gzip
Last-Modified
Wed, 29 Nov 2023 04:26:38 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45776
Connection
keep-alive
Content-Length
13233
Expires
Thu, 30 Nov 2023 04:26:03 GMT
usync.js
eus.rubiconproject.com/ Frame 7A79 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
d30ebe5017ee0a99c84556e36d105000a7352a72b16bdd457a813ff75197ce46

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=12776
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:07 GMT
Content-Encoding
gzip
Last-Modified
Wed, 29 Nov 2023 04:26:38 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45776
Connection
keep-alive
Content-Length
13233
Expires
Thu, 30 Nov 2023 04:26:03 GMT
usync.js
eus.rubiconproject.com/ Frame 6F39 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
d30ebe5017ee0a99c84556e36d105000a7352a72b16bdd457a813ff75197ce46

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=12776
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:07 GMT
Content-Encoding
gzip
Last-Modified
Wed, 29 Nov 2023 04:26:38 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45776
Connection
keep-alive
Content-Length
13233
Expires
Thu, 30 Nov 2023 04:26:03 GMT
usync.js
eus.rubiconproject.com/ Frame 31D5 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
d30ebe5017ee0a99c84556e36d105000a7352a72b16bdd457a813ff75197ce46

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=12776
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:07 GMT
Content-Encoding
gzip
Last-Modified
Wed, 29 Nov 2023 04:26:38 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45776
Connection
keep-alive
Content-Length
13233
Expires
Thu, 30 Nov 2023 04:26:03 GMT
usync.js
eus.rubiconproject.com/ Frame 6492 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-229-251.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
d30ebe5017ee0a99c84556e36d105000a7352a72b16bdd457a813ff75197ce46

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=12776
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:07 GMT
Content-Encoding
gzip
Last-Modified
Wed, 29 Nov 2023 04:26:38 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45776
Connection
keep-alive
Content-Length
13233
Expires
Thu, 30 Nov 2023 04:26:03 GMT
/
onetag-sys.com/usync/ Frame 972A 		2 KB
863 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=765b4e6bb9c8438&gdpr=0&gdpr_consent=
Requested by
Host: sdk.minutemedia-prebid.com
URL: https://sdk.minutemedia-prebid.com/cs-config/cs.html?org=6475aa705b23100001019b46&tc=6475aaf65fe06700018e50d8&as=6475aaf65fe06700018e50da&type=hb&wd=cs.minutemedia-prebid.com&domain=theepochtimes.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://sdk.minutemedia-prebid.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
cs
cs.minutemedia-prebid.com/ Frame 5B53
Redirect Chain
  • https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21480%26id%3D$UID
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21480%26id%3D%24UID
  • https://cs.minutemedia-prebid.com/cs?aid=21480&id=431352185976743711462
0
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.minutemedia-prebid.com/cs?aid=21480&id=431352185976743711462
Requested by
Host: sdk.minutemedia-prebid.com
URL: https://sdk.minutemedia-prebid.com/cs-config/cs.html?org=6475aa705b23100001019b46&tc=6475aaf65fe06700018e50d8&as=6475aaf65fe06700018e50da&type=hb&wd=cs.minutemedia-prebid.com&domain=theepochtimes.com
Protocol
H2
Server
18.200.44.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-44-133.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://sdk.minutemedia-prebid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://sdk.minutemedia-prebid.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs.minutemedia-prebid.com/cs?aid=21480&id=431352185976743711462
date
Wed, 29 Nov 2023 15:43:07 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel
ap.lijit.com/ Frame 5B53 		0
277 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21488%26id%3D%24UID
Requested by
Host: sdk.minutemedia-prebid.com
URL: https://sdk.minutemedia-prebid.com/cs-config/cs.html?org=6475aa705b23100001019b46&tc=6475aaf65fe06700018e50d8&as=6475aaf65fe06700018e50da&type=hb&wd=cs.minutemedia-prebid.com&domain=theepochtimes.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.14.14 , United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS
14.14.251.63.unassigned.ord.singlehop.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://sdk.minutemedia-prebid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 29 Nov 2023 15:43:07 GMT
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap1sea1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
cs
cs.minutemedia-prebid.com/ Frame 5B53
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=562963&ev=1&us_privacy=[US_PRIVACY]&gdpr=0&gdpr_consent=&rurl=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21494%26id%3D%25%25VGUID%25%25
  • https://cs.minutemedia-prebid.com/cs?aid=21494&id=6Eba1g0IjY3t&ev=1&us_privacy=[US_PRIVACY]&pid=562963&gdpr_consent=&gdpr=0
0
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.minutemedia-prebid.com/cs?aid=21494&id=6Eba1g0IjY3t&ev=1&us_privacy=[US_PRIVACY]&pid=562963&gdpr_consent=&gdpr=0
Requested by
Host: sdk.minutemedia-prebid.com
URL: https://sdk.minutemedia-prebid.com/cs-config/cs.html?org=6475aa705b23100001019b46&tc=6475aaf65fe06700018e50d8&as=6475aaf65fe06700018e50da&type=hb&wd=cs.minutemedia-prebid.com&domain=theepochtimes.com
Protocol
H2
Server
18.200.44.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-44-133.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://sdk.minutemedia-prebid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://sdk.minutemedia-prebid.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
de-CH
location
https://cs.minutemedia-prebid.com/cs?aid=21494&id=6Eba1g0IjY3t&ev=1&us_privacy=[US_PRIVACY]&pid=562963&gdpr_consent=&gdpr=0
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-74c7cffc45-rvnf5
expires
-1
cs
cs.minutemedia-prebid.com/ Frame 5B53
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=59&gdpr=0&gdpr_consent=
  • https://cs.minutemedia-prebid.com/cs?aid=21498&id=8109155695714381815&gdpr=0&gdpr_consent=
0
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.minutemedia-prebid.com/cs?aid=21498&id=8109155695714381815&gdpr=0&gdpr_consent=
Requested by
Host: sdk.minutemedia-prebid.com
URL: https://sdk.minutemedia-prebid.com/cs-config/cs.html?org=6475aa705b23100001019b46&tc=6475aaf65fe06700018e50d8&as=6475aaf65fe06700018e50da&type=hb&wd=cs.minutemedia-prebid.com&domain=theepochtimes.com
Protocol
H2
Server
18.200.44.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-44-133.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://sdk.minutemedia-prebid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://sdk.minutemedia-prebid.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs.minutemedia-prebid.com/cs?aid=21498&id=8109155695714381815&gdpr=0&gdpr_consent=
date
Wed, 29 Nov 2023 15:43:06 GMT
content-length
0
khaos.json
token.rubiconproject.com/ Frame 31D5 		7 B
809 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://token.rubiconproject.com/khaos.json?
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://eus.rubiconproject.com
Cache-Control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
7
X-RPHost
78e3bdce5107450057bade54d54a0a7e
Expires
0
khaos.json
token.rubiconproject.com/ Frame 7A79 		7 B
809 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://token.rubiconproject.com/khaos.json?
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://eus.rubiconproject.com
Cache-Control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
7
X-RPHost
78e3bdce5107450057bade54d54a0a7e
Expires
0
khaos.json
token.rubiconproject.com/ Frame 6F39 		7 B
809 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://token.rubiconproject.com/khaos.json?
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://eus.rubiconproject.com
Cache-Control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
7
X-RPHost
78e3bdce5107450057bade54d54a0a7e
Expires
0
khaos.json
token.rubiconproject.com/ Frame 6492 		7 B
809 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://token.rubiconproject.com/khaos.json?
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://eus.rubiconproject.com
Cache-Control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
7
X-RPHost
7d6e3b6fefbbeb4d018118d74243a2fc
Expires
0
khaos.json
token.rubiconproject.com/ Frame 8C0D 		7 B
809 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://token.rubiconproject.com/khaos.json?
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://eus.rubiconproject.com
Cache-Control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
7
X-RPHost
3bafef7aa4e37890defcd73f0a080481
Expires
0
quant.js
secure.quantserve.com/ 		21 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:e365:4988:e8a7:3270 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
77daa4388c965a3e23b5a6c800727d8025ab108f89cf5679e79136986d5b4561

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
gzip
etag
"e23JaXq4HVtlOmThpFhluQ=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Wed, 06 Dec 2023 15:43:07 GMT
/
a.clickcertain.com/px/
Redirect Chain
  • https://a.remarketstats.com/px/smart/?c=244b81b94c69796&seg=epochfun/spot-the-difference-daily-3956489
  • https://a.clickcertain.com/px/smart/a/?seg=epochfun/spot-the-difference-daily-3956489&c=244b81b94c69796
  • https://a.clickcertain.com/px/?c=244b81b94c69796
4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.clickcertain.com/px/?c=244b81b94c69796
Protocol
H2
Server
2606:4700:20::681a:832 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb38fd58abc07b914b84877f547b9cc6a91f08bdc759e2700f864d9d3cab7859

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
content-encoding
br
x-frontend
cc-nginx-5c6697d5bd-w672k:cc-nginx-5c6697d5bd-w672k
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-requestid
fc6a580d-2d93-4f61-b851-5c244c294c59
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qHmueFJgTrRyinOuMa%2Bo%2FmBnrbmO1LXleeyG4Uv%2Fo49v2zkp75%2FdQf%2B4mGG7GtAJXQwI6wH%2FpE2fitRyo29uFEedaUga3UEiNpOamsNag1d3t5wzymfwfTGwSqfWizu%2B6rDvtDqO394Ol7C9eytCiw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
cf-ray
82dbf6ea9f9c0e07-MXP

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
x-frontend
cc-nginx-5c6697d5bd-v66xw:cc-nginx-5c6697d5bd-v66xw
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-requestid
8b8e9529-aa0d-4811-85c9-a2f6cebfe8c6
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YAmWU79pfVF1NuNR6WgtIsCyJClJAx2dmER%2BtP2evJlrfbP11Aqbf6zpVyc1qaD2APmbx9IXc0BLBVyvp8JiMI3N%2FvsXtHSHxve1PRI9lMYtVtYjDdDEXi0CwMbKOqYBrWagw30XRkXRytfih72TZA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
location
https://a.clickcertain.com/px/?c=244b81b94c69796
cf-ray
82dbf6e9ae4f0e07-MXP
bat.js
bat.bing.com/ 		45 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Wed, 29 Nov 2023 15:43:07 GMT
last-modified
Fri, 10 Nov 2023 20:09:55 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 7A6D1331D2E84323A872C05A2B47486E Ref B: ZRHEDGE1910 Ref C: 2023-11-29T15:43:07Z
etag
"80abcdf1114da1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
13175
js
www.googletagmanager.com/gtag/ 		194 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-696467118
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5Z8H4H
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d6261756586039c521b33cec507a4a6bf7646e4352fe2dd29ff44b145286df5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
72281
x-xss-protection
0
last-modified
Wed, 29 Nov 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 29 Nov 2023 15:43:07 GMT
container.js
tags.wdsvc.net/
Redirect Chain
  • https://tags.wdsvc.net/controller.js?id=100415
  • https://tags.wdsvc.net/container.js?id=100415&v=4.10&t=1701272587768
28 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.wdsvc.net/container.js?id=100415&v=4.10&t=1701272587768
Protocol
HTTP/1.1
Server
52.202.83.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-202-83-199.compute-1.amazonaws.com
Software
/
Resource Hash
ddd2245c1fadd2a11a967993e9d1e4b91de6bd0e8622dfef98f20f228ca04f1d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Content-Type
text/javascript
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Keep-Alive
timeout=5
Content-length
28662
Expires
Mon, 3 Jan 2005 13:00:00 GMT

Redirect headers

location
https://tags.wdsvc.net/container.js?id=100415&v=4.10&t=1701272587768
Date
Wed, 29 Nov 2023 15:43:07 GMT
Cache-Control
private, no-cache
Connection
keep-alive
Keep-Alive
timeout=5
Transfer-Encoding
chunked
uwt.js
static.ads-twitter.com/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 18:55:37 GMT
x-amz-server-side-encryption
AES256
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100147-IAD, cache-fra-eddf8230033-FRA
6irth52s.js
js.alocdn.com/c/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.alocdn.com/c/6irth52s.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5Z8H4H
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-82.fra60.r.cloudfront.net
Software
nginx/1.20.1 /
Resource Hash
b1a48777454353c2b6ff6e617c2caf64c290e2ba4f55fd74a30d97f734198c21

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 12:38:28 GMT
via
1.1 5fa65194b963365c20fbd28444032cfc.cloudfront.net (CloudFront)
server
nginx/1.20.1
x-amz-cf-pop
FRA60-P1
age
11079
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=28800
x-amz-cf-id
xQIB01bbWGKtDSDOP9NMW1aATy-gQtVcZyBAq8WhKkyGAPQ-63RuXQ==
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=24003086&ns__t=1701272587463&ns_c=UTF-8&c8=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&c7=htt...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=24003086&ns__t=1701272587463&ns_c=UTF-8&c8=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&c7=ht...
0
224 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=24003086&ns__t=1701272587463&ns_c=UTF-8&c8=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&c7=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&c9=
Protocol
H2
Server
99.84.88.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-43.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 167c735142bc0b0bedf2cca27d970088.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
MUC50-C1
x-amz-cf-id
E2T2UyB7qDWnVdV5V572ie2_Fwu4UfUHYzfEk9hQvrHPeyRB5s4ymA==
x-cache
Miss from cloudfront

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 167c735142bc0b0bedf2cca27d970088.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
MUC50-C1
x-cache
Miss from cloudfront
location
/b2?c1=2&c2=24003086&ns__t=1701272587463&ns_c=UTF-8&c8=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&c7=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&c9=
content-length
0
x-amz-cf-id
n5b_njeIp08qgZ8x03mH-_Nnff3cEv2pc4nROsU62h7ZNSoy4pkAHg==
cs.js
sb.scorecardresearch.com/internal-c2/default/
Redirect Chain
  • https://sb.scorecardresearch.com/c2/24003086/cs.js
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
0
382 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/internal-c2/default/cs.js
Protocol
H2
Server
99.84.88.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-43.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 08:04:48 GMT
via
1.1 167c735142bc0b0bedf2cca27d970088.cloudfront.net (CloudFront)
last-modified
Mon, 03 Jul 2023 14:48:48 GMT
server
AmazonS3
x-amz-cf-pop
MUC50-C1
age
28692
x-amz-server-side-encryption
AES256
etag
"d41d8cd98f00b204e9800998ecf8427e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
0
x-amz-cf-id
BqkYJp-RKx2mGW09jvA_sg2N7BtS8yQ1ZKQHXZOJ2swdh1osVxbGsA==

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 167c735142bc0b0bedf2cca27d970088.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
MUC50-C1
x-cache
Miss from cloudfront
location
/internal-c2/default/cs.js
content-length
0
x-amz-cf-id
XLqjP9AGEgTGeiU3AcZ5OUtai3Dtsf70yYbCPZrrCGFcfC9Yt1-heg==
identity-sign-in-google-http
csp.withgoogle.com/csp/ Frame F378 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://csp.withgoogle.com/csp/identity-sign-in-google-http
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2011 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/csp-report

Response headers
identity-sign-in-google-http
csp.withgoogle.com/csp/ Frame C50E 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://csp.withgoogle.com/csp/identity-sign-in-google-http
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2011 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/csp-report

Response headers
rules-p-a128V7tctPVtT.js
rules.quantcount.com/ 		3 B
457 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-a128V7tctPVtT.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 08:33:10 GMT
via
1.1 ae3f020e2e89e632d339db198e9ba75a.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
age
26284
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
3
last-modified
Sat, 04 Mar 2017 20:44:26 GMT
server
AmazonS3
etag
"8a80554c91d9fca8acb82f023de02f11"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
x-amz-cf-id
kDZE7SLi7UDiwUHQ1xhg7BXcFLoEsP0C1yw37F0sNTBmFEnsE27drg==
identity-sign-in-google-http
csp.withgoogle.com/csp/ Frame 2349 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://csp.withgoogle.com/csp/identity-sign-in-google-http
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2011 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/csp-report

Response headers
identity-sign-in-google-http
csp.withgoogle.com/csp/ Frame 8E39 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://csp.withgoogle.com/csp/identity-sign-in-google-http
Requested by
Host: www.theepochtimes.com
URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2011 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/csp-report

Response headers
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/696467118/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/696467118/?random=1701272587565&cv=11&fst=1701272587565&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&hn=www.googleadservices.com&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&auid=1153095268.1701272584&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
cf145d0294d2ef90c4623482d53ee321535782fb7b9f59c10cbb4cfe34a7db95
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1341
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
usr.undertone.com/userPixel/ Frame 7A79
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776&khaos=LPJXRTOQ-N-6ZRW
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
0
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
5Bcj8s56BOIlQfqhRc9EvuDXDdCK7Hlp5eluAlP_-0P_YRlIXClVYg==
x-cache
Miss from cloudfront

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
cms-2c-rubicon.html
cti.w55c.net/ct/ Frame F3C8 		52 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cti.w55c.net/ct/cms-2c-rubicon.html
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.88.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-104.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ecb740996ce05e9b7823c9690564a0d7b3840becad640d37e929cd4f4ee1cdf4
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Referer
https://eus.rubiconproject.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

age
322237
cache-control
must-revalidate
content-encoding
br
content-type
text/html
date
Wed, 29 Nov 2023 06:32:04 GMT
etag
W/"7549d51888f0142460ac70be66758bc9"
last-modified
Fri, 17 Sep 2021 21:17:39 GMT
server
AmazonS3
strict-transport-security
max-age=2592000; includeSubDomains
vary
Accept-Encoding
via
1.1 04033844f25f5e47de102de77d8b5f4c.cloudfront.net (CloudFront)
x-amz-cf-id
HhxBSPH2507Bagx2qYlV5F0FZHInYHPfEm5q9hfvSxQuwqvx9--0fA==
x-amz-cf-pop
MUC50-C1
x-amz-replication-status
COMPLETED
x-amz-version-id
eM8rKv5bLrMqGrCvH619GCOhuiLqCbex
x-cache
Hit from cloudfront
138003605.js
bat.bing.com/p/action/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/138003605.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
1152f79a12543479de3ec4e56eaa913401cd934968ddfcbf833218f585a0e494
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
date
Wed, 29 Nov 2023 15:43:07 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: DA5F3C15E6B44C69B290787AB006A9C8 Ref B: ZRHEDGE1910 Ref C: 2023-11-29T15:43:07Z
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
cache-control
private,max-age=60
0
bat.bing.com/action/ 		0
286 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=138003605&Ver=2&mid=e47ed578-2877-4367-9fc6-7efbeae9c5a1&sid=fe033d408ecd11ee8e3cff6ba2d1f93b&vid=fe031e708ecd11ee8620dd95ba27fc47&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&p=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&r=&lt=3434&evt=pageLoad&sv=1&rn=440624
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 29 Nov 2023 15:43:07 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 1E594ABF03A847E2962AFFCE120528A5 Ref B: ZRHEDGE1910 Ref C: 2023-11-29T15:43:07Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/1/i/ 		43 B
206 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=6c88f916-676a-4a7d-862c-51b27be369a0&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=nzye8&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
163
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=0
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
914f31e9de933932
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
e0c635bed2a07083d67b6dc864562709edb259b6e2a76a2b5d8f7f96a38bc469
content-length
43
adsct
analytics.twitter.com/1/i/ 		43 B
547 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=6c88f916-676a-4a7d-862c-51b27be369a0&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=nzye8&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
159
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=631138519
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
504522d179998593
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
c55183a783f931f58daec1ae5415e883c33a653bed04a92b6d63270672e369b1
content-length
43
adsct
t.co/1/i/ 		43 B
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=e5b55571-b5ba-47ec-817e-de47ce43ec93&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=ofnz2&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
160
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=0
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
33f9c221b5b98dd1
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
e0c635bed2a07083d67b6dc864562709edb259b6e2a76a2b5d8f7f96a38bc469
content-length
43
adsct
analytics.twitter.com/1/i/ 		43 B
546 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=e5b55571-b5ba-47ec-817e-de47ce43ec93&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=ofnz2&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
160
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=631138519
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
c7c2e715eff38f58
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
c55183a783f931f58daec1ae5415e883c33a653bed04a92b6d63270672e369b1
content-length
43
adsct
t.co/1/i/ 		43 B
204 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=7ba91708-9be0-4620-85db-7dad995b9c86&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=odl9r&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
161
date
Wed, 29 Nov 2023 15:43:06 GMT
strict-transport-security
max-age=0
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
40745d3cd97f0de9
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
e0c635bed2a07083d67b6dc864562709edb259b6e2a76a2b5d8f7f96a38bc469
content-length
43
adsct
analytics.twitter.com/1/i/ 		43 B
726 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=7ba91708-9be0-4620-85db-7dad995b9c86&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=odl9r&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
157
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=631138519
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
120ec87227ebcd1f
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
c55183a783f931f58daec1ae5415e883c33a653bed04a92b6d63270672e369b1
content-length
43
adsct
t.co/1/i/ 		43 B
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=57fb5fa5-fe24-454a-beaa-c6a7b432c137&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=ofy5s&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
157
date
Wed, 29 Nov 2023 15:43:06 GMT
strict-transport-security
max-age=0
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
3c2164b7faed3b7e
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
e0c635bed2a07083d67b6dc864562709edb259b6e2a76a2b5d8f7f96a38bc469
content-length
43
adsct
analytics.twitter.com/1/i/ 		43 B
543 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=57fb5fa5-fe24-454a-beaa-c6a7b432c137&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=ofy5s&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
159
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=631138519
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
b4e4726ff361be29
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
c55183a783f931f58daec1ae5415e883c33a653bed04a92b6d63270672e369b1
content-length
43
adsct
t.co/1/i/ 		43 B
205 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=f427248d-0f6d-44e2-8c76-b44a693e21fb&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=od4qh&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
166
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=0
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
11e5f6e79fa76f8b
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
e0c635bed2a07083d67b6dc864562709edb259b6e2a76a2b5d8f7f96a38bc469
content-length
43
adsct
analytics.twitter.com/1/i/ 		43 B
540 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=f427248d-0f6d-44e2-8c76-b44a693e21fb&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4d769307-39cf-448b-be55-5e603631a242&tw_document_href=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tw_iframe_status=0&txn_id=od4qh&type=javascript&version=2.3.29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
160
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=631138519
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
4015802d3a4db168
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
c55183a783f931f58daec1ae5415e883c33a653bed04a92b6d63270672e369b1
content-length
43
/
www.google.com/pagead/1p-user-list/696467118/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/696467118/?random=1701272587565&cv=11&fst=1701270000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNgiln8HUxFv8NtxvEJ1-VtRoV18szOHD8SnhVqFA5f0JScMC7&random=1837326011&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ch/pagead/1p-user-list/696467118/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ch/pagead/1p-user-list/696467118/?random=1701272587565&cv=11&fst=1701270000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&frm=0&tiba=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNgiln8HUxFv8NtxvEJ1-VtRoV18szOHD8SnhVqFA5f0JScMC7&random=1837326011&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 7A79
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/cvtiwsBoANbINg2ZgB56pg?csrc=
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-g33_PpZE2oKPCquAJzkMFncv0nLbG7cmI_fWkg--~A
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-g33_PpZE2oKPCquAJzkMFncv0nLbG7cmI_fWkg--~A
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-g33_PpZE2oKPCquAJzkMFncv0nLbG7cmI_fWkg--~A
content-length
0
rubicon
match.adsrvr.org/track/cmf/ Frame 7A79 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/rubicon
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
Kestrel
content-length
70
content-type
image/gif
ecm3
s.amazon-adsystem.com/ Frame 7A79
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
  • https://s.amazon-adsystem.com/ecm3?id=LPJXRTOQ-N-6ZRW&ex=d-rubiconproject.com&status=ok
43 B
720 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=LPJXRTOQ-N-6ZRW&ex=d-rubiconproject.com&status=ok
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
BCX9CAB99HT2QZR19CCJ
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://s.amazon-adsystem.com/ecm3?id=LPJXRTOQ-N-6ZRW&ex=d-rubiconproject.com&status=ok
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
ecm3
aax-eu.amazon-adsystem.com/s/ Frame 7A79
Redirect Chain
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=AvxQqwWuS-CJtktPCCH6GA&rk=usync-other
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=AvxQqwWuS-CJtktPCCH6GA
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=AvxQqwWuS-CJtktPCCH6GA
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
67.220.226.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:08 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
Z3DWQDXQ0XZAWDD6EPE6
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=AvxQqwWuS-CJtktPCCH6GA
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 7A79
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPHNxgdaIf8oTboOri6iZYc&google_cver=1
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPHNxgdaIf8oTboOri6iZYc&google_cver=1
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPHNxgdaIf8oTboOri6iZYc&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
px.ads.linkedin.com/ Frame 7A79
Redirect Chain
  • https://token.rubiconproject.com/token?pid=36584
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPJXRTOQ-N-6ZRW
0
649 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 9EF6E070B2504CE4B71FD078B9792C14 Ref B: ZRHEDGE0708 Ref C: 2023-11-29T15:43:07Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYLTGRESexBxQ1rywNR4w==

Redirect headers

Location
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPJXRTOQ-N-6ZRW
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
78e3bdce5107450057bade54d54a0a7e
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
ecm3
s.amazon-adsystem.com/ Frame 7A79
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=cRFLMGS8T42hPPQ12yVpqQ&rk=usync-na
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=cRFLMGS8T42hPPQ12yVpqQ
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=cRFLMGS8T42hPPQ12yVpqQ
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:08 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
P73ZMSNW0R79T0NSPXR0
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=cRFLMGS8T42hPPQ12yVpqQ
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame 7A79
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFBKWFJUT1EtTi02WlJX
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENP3WfCipIEuk5lVIaJ1oTM&google_cver=1
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBKWFJUT1EtTi02WlJX&google_push=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBKWFJUT1EtTi02WlJX&google_push=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H3
Server
142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBKWFJUT1EtTi02WlJX&google_push=
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
pixel
cm.g.doubleclick.net/ Frame 7A79
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NWIwNjc3MmNjZTRmNWZjMWM4NTk5MDdlZjIyZDljODhkZWY3YzEwYw
170 B
243 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NWIwNjc3MmNjZTRmNWZjMWM4NTk5MDdlZjIyZDljODhkZWY3YzEwYw
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NWIwNjc3MmNjZTRmNWZjMWM4NTk5MDdlZjIyZDljODhkZWY3YzEwYw
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
78e3bdce5107450057bade54d54a0a7e
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 7A79
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp
  • https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&_bee_ppp=1
  • https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAD_007KzrgAABRHedWbqg&expires=30
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAD_007KzrgAABRHedWbqg&expires=30
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
402fba8a82f093def2459220061c8d31
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAD_007KzrgAABRHedWbqg&expires=30
Date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
setuid
ib.adnxs.com/prebid/ Frame 7A79
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
  • https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
43 B
941 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.23.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
an-x-request-uuid
d005fb37-d103-479c-83b3-be8f47a95f71
server
nginx/1.23.4
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
image/gif
cache-control
no-store, no-cache, private
x-proxy-origin
185.195.71.217; 185.195.71.217; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length
43
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
merge
ce.lijit.com/ Frame 7A79
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn
  • https://ce.lijit.com/merge?pid=80&3pid=LPJXRTOQ-N-6ZRW
0
311 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=80&3pid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
216.52.2.6 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Expires
Fri, 20 Mar 2009 00:00:00 GMT
Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
X-MERGE
GDPR Optout true
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2ams1
P3P
CP="CUR ADM OUR NOR STA NID"

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ce.lijit.com/merge?pid=80&3pid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
liveCS.php
live.primis.tech/live/ Frame 7A79
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=primis
  • https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LPJXRTOQ-N-6ZRW
0
523 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
108.138.36.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-36-33.muc50.r.cloudfront.net
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:08 GMT
content-encoding
gzip
via
1.1 beaace02cc7004781239800a1c484ca0.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
MUC50-P2
age
0
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/html; charset=utf-8
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
no-store
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
8h5gcah4YWWkcfUWIBhi0WRu767Sb9-Uw-QirhM3Qdt7aQ-uA4dctA==

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
magnite
prebid.a-mo.net/setuid/ Frame 7A79
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
  • https://prebid.a-mo.net/setuid/magnite?uid=LPJXRTOQ-N-6ZRW
0
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://prebid.a-mo.net/setuid/magnite?uid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
145.40.97.66 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
0
server
envoy
vary
Accept-Encoding

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://prebid.a-mo.net/setuid/magnite?uid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 7A79
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30
  • https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=2e121d07-9736-44ed-b08e-9137df2b6ccd&expires=30
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=2e121d07-9736-44ed-b08e-9137df2b6ccd&expires=30
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=2e121d07-9736-44ed-b08e-9137df2b6ccd&expires=30
Date
Wed, 29 Nov 2023 15:43:08 GMT
Connection
keep-alive
X-CI-RTID
0fa92eeb-dac5-448a-b646-3216bb2c6a53
Content-Length
144
Content-Type
text/html; charset=utf-8
pixel
capi.connatix.com/us/ Frame 7A79
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=19564
  • https://capi.connatix.com/us/pixel?puid=LPJXRTOQ-N-6ZRW&pId=11&gdpr=&gdpr_consent=&us_privacy=
  • https://capi.connatix.com/us/pixel?puid=LPJXRTOQ-N-6ZRW&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
82 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://capi.connatix.com/us/pixel?puid=LPJXRTOQ-N-6ZRW&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
cf-cache-status
DYNAMIC
server
cloudflare
surrogate-control
no-cache, no-store, must-revalidate, max-age=0
vary
Accept-Encoding
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-ray
82dbf6ebcef10200-ZRH
access-control-allow-headers
x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Wed, 29 Nov 2023 15:43:08 GMT
cf-cache-status
DYNAMIC
server
cloudflare
location
https://capi.connatix.com/us/pixel?puid=LPJXRTOQ-N-6ZRW&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-ray
82dbf6eb5e060200-ZRH
access-control-allow-headers
x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length
0
alt-svc
h3=":443"; ma=86400
check
pixel.tapad.com/idsync/ex/receive/ Frame 31D5
Redirect Chain
  • https://token.rubiconproject.com/token?pid=37556&a=1
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LPJXRTOQ-N-6ZRW
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=LPJXRTOQ-N-6ZRW
95 B
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H3
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
Jetty(11.0.13) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=LPJXRTOQ-N-6ZRW
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
cksync
hb.yahoo.net/ Frame 31D5
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LPJXRTOQ-N-6ZRW&redir=true
  • https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=58160&ovsid=LPJXRTOQ-N-6ZRW&redir=true
  • https://hb.yahoo.net/cksync?cs=63&axid_e=eS0uZGhVZ0RaRTJ1RXdvQVJmaWF0Nl9DR1gzcTJmVkpLVX5B&ovsid=LPJXRTOQ-N-6ZRW&dpid=58160
52 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hb.yahoo.net/cksync?cs=63&axid_e=eS0uZGhVZ0RaRTJ1RXdvQVJmaWF0Nl9DR1gzcTJmVkpLVX5B&ovsid=LPJXRTOQ-N-6ZRW&dpid=58160
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
23.48.23.23 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-48-23-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5f20338b9aab2f5f33562eb3b0b23d999896ce426cacd2231b4123510571df4e
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=86400 ; includeSubDomains, max-age=604800
date
Wed, 29 Nov 2023 15:43:07 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
52
x-mnet-hl2
E
expires
Wed, 29 Nov 2023 15:43:07 GMT

Redirect headers

location
https://hb.yahoo.net/cksync?cs=63&axid_e=eS0uZGhVZ0RaRTJ1RXdvQVJmaWF0Nl9DR1gzcTJmVkpLVX5B&ovsid=LPJXRTOQ-N-6ZRW&dpid=58160
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
v1
match.sharethrough.com/sync/ Frame 31D5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LPJXRTOQ-N-6ZRW
0
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
3.72.120.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-72-120-49.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
Rubicon
s.seedtag.com/cs/cookiesync/ Frame 31D5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=seedtag
  • https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LPJXRTOQ-N-6ZRW
0
284 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
34.149.50.64 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
64.50.149.34.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 google
access-control-allow-credentials
true
server
openresty
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-methods
GET, POST, OPTIONS, DELETE, PUT, HEAD

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
cookiesync
bttrack.com/pixel/ Frame 31D5 		35 B
163 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bttrack.com/pixel/cookiesync?source=c91bfcce-bb43-46f7-b14e-567c0a4332b3
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.132.33.68 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS
NET-33-132-192.68.bidtellect.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-servername
Track002-iad
pragma
no-cache
date
Wed, 29 Nov 2023 15:42:39 GMT
strict-transport-security
max-age=31536000;
content-type
image/gif
cache-control
private,no-cache
content-length
35
expires
-1
tap.php
pixel.rubiconproject.com/ Frame 31D5
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=14
  • https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=Ol13Km9rW5N_haph2upMcrnDR9k
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=Ol13Km9rW5N_haph2upMcrnDR9k
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=Ol13Km9rW5N_haph2upMcrnDR9k
Date
Wed, 29 Nov 2023 15:43:07 GMT
Connection
keep-alive
Content-Length
121
Content-Type
text/html; charset=utf-8
tap.php
pixel.rubiconproject.com/ Frame 31D5
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=1164
  • https://c1.adform.net/serving/cookie/match?CC=1&party=1164
  • https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=3199104349002520066
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=3199104349002520066
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=3199104349002520066
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
tap.php
pixel.rubiconproject.com/ Frame 31D5
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=6&p=70&cp=Rubicon&cu=1&url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D6434%26nid%3D2149%26put%3D%40%40CRITEO_USERID%40%40
  • https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=b96e9db1-3894-42bb-b605-10b056c02dc6
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=b96e9db1-3894-42bb-b605-10b056c02dc6
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=b96e9db1-3894-42bb-b605-10b056c02dc6
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1159736
content-length
0
expires
Wed, 29 Nov 2023 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 31D5
Redirect Chain
  • https://ad.turn.com/r/cs?pid=6
  • https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=8094047327731269571&expires=60&gdpr=&gdpr_consent=
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=8094047327731269571&expires=60&gdpr=&gdpr_consent=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=8094047327731269571&expires=60&gdpr=&gdpr_consent=
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
getuidnb
secure.adnxs.com/ Frame 31D5 		43 B
575 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.adnxs.com/getuidnb?https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4894%26nid%3D1986%26put%3D$UID%26expires%3D30
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.23.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
an-x-request-uuid
af14f38e-cb34-4564-afa4-2788fe8670a6
server
nginx/1.23.4
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
185.195.71.217; 185.195.71.217; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length
43
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 31D5
Redirect Chain
  • https://sync.1rx.io/usersync2/rubicon
  • https://sync.1rx.io/usersync2/rubicon?zcc=1&cb=1701272587908
  • https://ad.turn.com/r/cs?pid=45&rndcb=144604005
  • https://sync.1rx.io/usersync/turn/8166104921769197507?dspret=1&gdpr=&gdpr_consent=&us_privacy=
  • https://sync.targeting.unrulymedia.com/csync/RX-c7b9ee18-5405-4b53-9cd4-cf4ab127c5c1-003?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D186028%26nid%3D4112%26put%3DRX-c7b9ee18-5405-4b...
  • https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-c7b9ee18-5405-4b53-9cd4-cf4ab127c5c1-003&expires=30
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-c7b9ee18-5405-4b53-9cd4-cf4ab127c5c1-003&expires=30
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-c7b9ee18-5405-4b53-9cd4-cf4ab127c5c1-003&expires=30
date
Wed, 29 Nov 2023 15:43:08 GMT
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RXc7b9ee1854054b539cd4cf4ab127c5c1003
content-type
text/html
709414.gif
id.rlcdn.com/ Frame 31D5 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709414.gif
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
sync
visitor.omnitagjs.com/visitor/ Frame 31D5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=adyoulike
  • https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPJXRTOQ-N-6ZRW&name=RUBICON
49 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPJXRTOQ-N-6ZRW&name=RUBICON
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
52.210.49.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-49-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
via
kong/2.8.4
x-content-type-options
nosniff
x-kong-proxy-latency
1
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
9
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPJXRTOQ-N-6ZRW&name=RUBICON
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
RX-2ee79b4d-6e9f-4a7e-859b-9ddbfe984d29-003
sync.targeting.unrulymedia.com/csync/ Frame 31D5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly
  • https://sync.1rx.io/usersync/rubicon/LPJXRTOQ-N-6ZRW
  • https://sync.1rx.io/usersync/rubicon/LPJXRTOQ-N-6ZRW?zcc=1&cb=1701272587935
  • https://sync.targeting.unrulymedia.com/csync/RX-2ee79b4d-6e9f-4a7e-859b-9ddbfe984d29-003
43 B
378 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-2ee79b4d-6e9f-4a7e-859b-9ddbfe984d29-003
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
46.228.174.117 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
content-length
43
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location
https://sync.targeting.unrulymedia.com/csync/RX-2ee79b4d-6e9f-4a7e-859b-9ddbfe984d29-003
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cache-control
no-store, no-cache, must-revalidate
expires
0
content-type
text/html
cs
cs.yellowblue.io/ Frame 31D5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=rise_engage
  • https://cs.yellowblue.io/cs?aid=11590&id=LPJXRTOQ-N-6ZRW
0
326 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11590&id=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
54.216.109.54 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-109-54.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://eus.rubiconproject.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
4
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cs.yellowblue.io/cs?aid=11590&id=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
redirect
exchange.mediavine.com/usersync/ Frame 31D5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17404
  • https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LPJXRTOQ-N-6ZRW
0
186 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
18.184.49.101 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-184-49-101.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
cache-control
private, no-cache
access-control-allow-credentials
true
content-encoding
gzip
vary
Origin, Accept-Encoding
content-type
text/html; charset=utf-8

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
60909
i6.liadm.com/s/ Frame 6492
Redirect Chain
  • https://token.rubiconproject.com/token?pid=49096
  • https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LPJXRTOQ-N-6ZRW
  • https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LPJXRTOQ-N-6ZRW
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
2600:1f18:ed:550a:3539:381b:7999:2df1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:08 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
0
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LPJXRTOQ-N-6ZRW
Date
Wed, 29 Nov 2023 15:43:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
1
cs
cs.minutemedia-prebid.com/ Frame 6492
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=minute_media
  • https://cs.minutemedia-prebid.com/cs?aid=21479&id=LPJXRTOQ-N-6ZRW
0
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.minutemedia-prebid.com/cs?aid=21479&id=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
18.200.44.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-44-133.eu-west-1.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://eus.rubiconproject.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cs.minutemedia-prebid.com/cs?aid=21479&id=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
/
ssc-cms.33across.com/ps/ Frame 6492
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=33across
  • https://ssc-cms.33across.com/ps/?xi=1&xu=LPJXRTOQ-N-6ZRW
0
73 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssc-cms.33across.com/ps/?xi=1&xu=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
67.202.105.24 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip24.67-202-105.static.steadfastdns.net
Software
33XP015 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-33x-status
2020008
date
Wed, 29 Nov 2023 15:43:07 GMT
server
33XP015

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ssc-cms.33across.com/ps/?xi=1&xu=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
setuid
s2s.t13.io/ Frame 6492
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-triple13
  • https://s2s.t13.io/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
86 B
449 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s2s.t13.io/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
113.140.107.34.bc.googleusercontent.com
Software
/
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
content-encoding
gzip
via
1.1 google
content-type
image/png
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://s2s.t13.io/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
143
match.deepintent.com/usersync/ Frame 6492 		0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/143
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.91.45.7 Ashburn, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software
c /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-length
0
server
c
cookie-sync
sync.outbrain.com/ Frame 6492
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=outbrain
  • https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LPJXRTOQ-N-6ZRW&obUid=&initiator=
0
145 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LPJXRTOQ-N-6ZRW&obUid=&initiator=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
64.202.112.95 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 29 Nov 2023 15:43:08 GMT
Cache-Control
no-cache
X-TraceId
a5292f177d64cc5312579bdd5e0a3180
Content-Length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LPJXRTOQ-N-6ZRW&obUid=&initiator=
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 6492
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=ZWdcCwADQpy1QABU
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=ZWdcCwADQpy1QABU
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by
cache-mxp6937-MXP
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 varnish
server
Varnish
x-timer
S1701272588.702911,VS0,VE0
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=ZWdcCwADQpy1QABU
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
tap.php
pixel.rubiconproject.com/ Frame 6492
Redirect Chain
  • https://um.simpli.fi/rb_match
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=D2CB47E4AB91487CBCDB48C9EEE02968&expires=365
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=D2CB47E4AB91487CBCDB48C9EEE02968&expires=365
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
402fba8a82f093def2459220061c8d31
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=D2CB47E4AB91487CBCDB48C9EEE02968&expires=365
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Tue, 28 Nov 2023 15:43:07 GMT
bridge
cm.adgrx.com/ Frame 6492 		43 B
282 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.adgrx.com/bridge?AG_SETCOOKIE&AG_PID=rubicon
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.251.241.196 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
Cowboy /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
server
Cowboy
content-type
image/gif
p3p
CP="NOI OTC OTP OUR NOR"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, proxy-revalidate
x-realserver-nx
ams-delivery-5
content-length
43
expires
Thu, 23 Sep 2004 17:42:04 GMT
rubicon
tr.blismedia.com/v1/api/sync/ Frame 6492 		0
173 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.blismedia.com/v1/api/sync/rubicon
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.105.96.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
tap.php
pixel.rubiconproject.com/ Frame 6492
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2046&pt=n&a=1
  • https://rubicon-match.dotomi.com/match/bounce/current?networkId=12783&version=1&nuid=L2uoynzTJmrcX0mFezNCOA
  • https://rubicon-match.dotomi.com/match/bounce/current?DotomiTest=58b5e8911052170a&is_secure=true&networkId=12783&version=1&nuid=L2uoynzTJmrcX0mFezNCOA
  • https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAAHvbrPtqGxAwN4cOmEAAAAAAA&expiration=1701358988&nuid=L2uoynzTJmrcX0mFezNCOA&is_secure=true
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAAHvbrPtqGxAwN4cOmEAAAAAAA&expiration=1701358988&nuid=L2uoynzTJmrcX0mFezNCOA&is_secure=true
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:08 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAAHvbrPtqGxAwN4cOmEAAAAAAA&expiration=1701358988&nuid=L2uoynzTJmrcX0mFezNCOA&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
Rubicon
crb.kargo.com/api/v1/dsync/ Frame 6492
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=11864
  • https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LPJXRTOQ-N-6ZRW
43 B
375 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
18.195.70.244 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-70-244.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:08 GMT
x-accel-expires
0
vary
Origin
x-rejected
consent
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 6492
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=560687&ev=1&rurl=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D390200%26nid%3D5120%26put%3D%25%25VGUID%25%25
  • https://pixel.rubiconproject.com/tap.php?v=390200&nid=5120&put=6Eba1g0IjY3t&ev=1&pid=560687
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=390200&nid=5120&put=6Eba1g0IjY3t&ev=1&pid=560687
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
402fba8a82f093def2459220061c8d31
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
de-CH
location
https://pixel.rubiconproject.com/tap.php?v=390200&nid=5120&put=6Eba1g0IjY3t&ev=1&pid=560687
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-74c7cffc45-rvnf5
expires
-1
i.match
s.tribalfusion.com/z/ Frame 6492
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b10&u={rubicon_user_token}&redirect=https%3A//pixel.rubiconproject.com/tap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180
  • https://s.tribalfusion.com/z/i.match?p=b10&u={rubicon_user_token}&redirect=https%3A//pixel.rubiconproject.com/tap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180
43 B
406 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.tribalfusion.com/z/i.match?p=b10&u={rubicon_user_token}&redirect=https%3A//pixel.rubiconproject.com/tap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:08 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
82dbf6eb5bc2f188-CDG
alt-svc
h3=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:08 GMT
cf-cache-status
DYNAMIC
x-function
206
server
cloudflare
x-reuse-index
712
content-type
text/html
location
https://s.tribalfusion.com/z/i.match?p=b10&u={rubicon_user_token}&redirect=https%3A//pixel.rubiconproject.com/tap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
82dbf6ea2a0af188-CDG
alt-svc
h3=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
usr.undertone.com/userPixel/ Frame 6492
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=12776
  • https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
0
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
99.84.88.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-111.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 39ed76664123c3090231ff0882467152.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
dV3SlmbJNcdjbzsFpvWvZOJAeWtI0xLjaRKz6Nj5V-c5wbMr8qTCBQ==
x-cache
Miss from cloudfront

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
setuid
prebid-s2s.media.net/ Frame 6492
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-medianet
  • https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
86 B
509 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
envoy /
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 google
server
envoy
content-type
image/png
access-control-allow-origin
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
0
access-control-allow-credentials
true
alt-svc
clear
expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
cookiesyncendpoint
sync.aniview.com/ Frame 6F39
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17184
  • https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LPJXRTOQ-N-6ZRW
0
251 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
96.46.186.182 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
content-length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=7
  • https://pixel.rubiconproject.com/tap.php?v=101732&nid=3822&put=7306910122771347601&expires=730
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=101732&nid=3822&put=7306910122771347601&expires=730
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=101732&nid=3822&put=7306910122771347601&expires=730
Date
Wed, 29 Nov 2023 15:43:07 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
sync
ads.yieldmo.com/ Frame 6F39
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=yieldmo
  • https://ads.yieldmo.com/sync?pn_id=rc&id=LPJXRTOQ-N-6ZRW
43 B
600 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/sync?pn_id=rc&id=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
52.209.84.7 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-84-7.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ads.yieldmo.com/sync?pn_id=rc&id=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
/
rtb-csync.smartadserver.com/redir/ Frame 6F39
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=smartadserver
  • https://rtb-csync.smartadserver.com/redir/?partnerid=104&partneruserid=LPJXRTOQ-N-6ZRW
43 B
326 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=104&partneruserid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://rtb-csync.smartadserver.com/redir/?partnerid=104&partneruserid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://ums.acuityplatform.com/tum?umid=2
  • https://pixel.rubiconproject.com/tap.php?v=5672&nid=2082&put=858191110320&expires=30&us_privacy=1---
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=5672&nid=2082&put=858191110320&expires=30&us_privacy=1---
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

access-control-allow-origin
*
location
https://pixel.rubiconproject.com/tap.php?v=5672&nid=2082&put=858191110320&expires=30&us_privacy=1---
content-length
0
tap.php
pixel.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://b1sync.zemanta.com/usersync/rubicon/
  • https://pixel.rubiconproject.com/tap.php?v=144598&nid=3992&expires=30&put=
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=144598&nid=3992&expires=30&put=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=144598&nid=3992&expires=30&put=
Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:07 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
109
Content-Type
text/html; charset=utf-8
/
csync.loopme.me/ Frame 6F39
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=loopme
  • https://csync.loopme.me/?partner_id=1441&vt=&uid=LPJXRTOQ-N-6ZRW
0
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://csync.loopme.me/?partner_id=1441&vt=&uid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
35.214.210.123 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
123.210.214.35.bc.googleusercontent.com
Software
_ /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
server
_

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://csync.loopme.me/?partner_id=1441&vt=&uid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
setuid
sync.ex.co/v1/ Frame 6F39
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17136_2
  • https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LPJXRTOQ-N-6ZRW
86 B
376 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
34.228.147.1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-228-147-1.compute-1.amazonaws.com
Software
/
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
date
Wed, 29 Nov 2023 15:43:08 GMT
access-control-allow-credentials
true
content-length
86
vary
Origin
content-type
image/png

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://rbp.mxptint.net/sn.ashx
  • https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R35CAB_10CE9DDD0_40041FD0&expires=60
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R35CAB_10CE9DDD0_40041FD0&expires=60
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R35CAB_10CE9DDD0_40041FD0&expires=60
Date
Wed, 29 Nov 2023 15:43:07 GMT
Cache-Control
private
Strict-Transport-Security
max-age=-384277387; includeSubDomains
P3P
CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length
227
Content-Type
text/html; charset=utf-8
usersync
e.serverbid.com/ Frame 6F39
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=24856
  • https://e.serverbid.com/usersync?cn=5529&ttt=1&dpui=LPJXRTOQ-N-6ZRW
35 B
405 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/usersync?cn=5529&ttt=1&dpui=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
159.89.246.130 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
content-encoding
gzip
access-control-max-age
10080
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
https://eus.rubiconproject.com
access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept
content-length
58

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://e.serverbid.com/usersync?cn=5529&ttt=1&dpui=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
402fba8a82f093def2459220061c8d31
Expires
0
138003605
www.clarity.ms/tag/uet/ 		828 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/uet/138003605
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/138003605.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
cf2655168c9eaa1ed5fd7c01137b293e847ef49bec2f885703d9313608e0749c

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

request-context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
date
Wed, 29 Nov 2023 15:43:08 GMT
x-azure-ref
0DFxnZQAAAAA8RY1UZJsjSr+fPv05TYuPWlJIRURHRTA2MTIANmNmYmVlZTAtNTAyNy00ODRiLTg5NjctNGEyOWFmNzdmMWUx
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
content-length
828
expires
-1
tap.php
pixel.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://cms.quantserve.com/pixel/p-e4m3Yko6bFYVc.gif?idmatch=0
  • https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=uwRn17hSYYKgB2DQuVR8hOsIaNSgU2PR7wb3SAz2
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=uwRn17hSYYKgB2DQuVR8hOsIaNSgU2PR7wb3SAz2
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
402fba8a82f093def2459220061c8d31
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=uwRn17hSYYKgB2DQuVR8hOsIaNSgU2PR7wb3SAz2
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
user.sync
match.sync.ad.cpe.dotomi.com/w/ Frame 6F39
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=epsilon
  • https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LPJXRTOQ-N-6ZRW
43 B
334 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LPJXRTOQ-N-6ZRW
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
H2
Server
2a02:fa8:8806:21::1780 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:08 GMT
server
nginx
accept-ch
Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
content-type
image/gif
cache-control
no-cache
content-length
43
expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=87
  • https://pixel.rubiconproject.com/tap.php?v=333994&nid=4804&put=8325801272123076523&gdpr=0&gdpr_consent=
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=333994&nid=4804&put=8325801272123076523&gdpr=0&gdpr_consent=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=333994&nid=4804&put=8325801272123076523&gdpr=0&gdpr_consent=
date
Wed, 29 Nov 2023 15:43:07 GMT
content-length
0
tap.php
pixel.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://match.adsby.bidtheatre.com/rubiconmatch
  • https://pixel.rubiconproject.com/tap.php?v=17039&nid=2650&days=30&gdpr=&gdpr_consent=&put=bf9086ab-e8ba-45bb-90be-499af4372459
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=17039&nid=2650&days=30&gdpr=&gdpr_consent=&put=bf9086ab-e8ba-45bb-90be-499af4372459
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
402fba8a82f093def2459220061c8d31
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=17039&nid=2650&days=30&gdpr=&gdpr_consent=&put=bf9086ab-e8ba-45bb-90be-499af4372459
Date
Wed, 29 Nov 2023 15:43:07 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=2999
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
tap.php
pixel.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=rubicon
  • https://x.bidswitch.net/ul_cb/sync?ssp=rubicon
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=rubicon&bsw_custom_parameter=703c8abe-24c7-4b70-aa60-bbf93e93964e
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=rubicon&bsw_custom_parameter=703c8abe-24c7-4b70-aa60-bbf93e93964e
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=66271bd1-5204-4bab-902d-e29bf870fd9b&user_group=1&ssp=rubicon&bsw_param=703c8abe-24c7-4b70-aa60-bbf93e93964e
  • https://pixel.rubiconproject.com/tap.php?v=15796&nid=2760&put=703c8abe-24c7-4b70-aa60-bbf93e93964e&expires=30&gdpr=&gdpr_consent=&us_privacy=
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=15796&nid=2760&put=703c8abe-24c7-4b70-aa60-bbf93e93964e&expires=30&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
//pixel.rubiconproject.com/tap.php?v=15796&nid=2760&put=703c8abe-24c7-4b70-aa60-bbf93e93964e&expires=30&gdpr=&gdpr_consent=&us_privacy=
date
Wed, 29 Nov 2023 15:43:08 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
tap.php
pixel.rubiconproject.com/ Frame 6F39
Redirect Chain
  • https://s.company-target.com/s/rp
  • https://pixel.rubiconproject.com/tap.php?v=1181926&nid=5578&put=75608216-8d33-459b-8783-54e4d5df9632
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=1181926&nid=5578&put=75608216-8d33-459b-8783-54e4d5df9632
Requested by
Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 google
access-control-allow-methods
GET,OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*.rubiconproject.com
location
https://pixel.rubiconproject.com/tap.php?v=1181926&nid=5578&put=75608216-8d33-459b-8783-54e4d5df9632
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
131
tap.php
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://tg.socdm.com/rtb/sync?proto=rubicon
  • https://pixel.rubiconproject.com/tap.php?v=71722&nid=3668&expires=30&put=ZWdcDMCo5tEAAK97Ji4AAAAA
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=71722&nid=3668&expires=30&put=ZWdcDMCo5tEAAK97Ji4AAAAA
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

X-SO-Cluster-ID
0
Date
Wed, 29 Nov 2023 15:43:08 GMT
X-SO-LB-Data
{"ban":false,"clean_query":"\/rtb\/sync?proto=rubicon","cluster_id":0,"gdpr":false,"ipv4":"185.195.71.217","key":"ZWdcDMCo5tEAAK97Ji4AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad430"}
X-SO-Key
ZWdcDMCo5tEAAK97Ji4AAAAA
Server
nginx
X-SO-Upstream-ID
m-ad430
P3P
CP="See also http://www.scaleout.jp/privacy/"
Location
https://pixel.rubiconproject.com/tap.php?v=71722&nid=3668&expires=30&put=ZWdcDMCo5tEAAK97Ji4AAAAA
Cache-Control
private
X-SO-HostName
m-ad430.dc4p.scaleout.jp
Connection
keep-alive
X-SO-Ads-Time
1
Content-Length
0
X-SO-LB-Hostname
a-tgng40013.dc2p.scaleout.jp
X-SO-IP
185.195.71.217
o
usync.vrtcal.com/ Frame 8C0D
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16466
  • https://usync.vrtcal.com/o?xs=1624&did=LPJXRTOQ-N-6ZRW
35 B
257 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usync.vrtcal.com/o?xs=1624&did=LPJXRTOQ-N-6ZRW
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
H2
Server
54.219.114.202 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-219-114-202.us-west-1.compute.amazonaws.com
Software
Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.26
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
server
Apache/2.4.7 (Ubuntu)
x-powered-by
PHP/5.5.9-1ubuntu4.26
content-length
35
content-type
image/gif

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usync.vrtcal.com/o?xs=1624&did=LPJXRTOQ-N-6ZRW
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
Expires
0
9.gif
id5-sync.com/i/175/ Frame 8C0D 		43 B
921 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id5-sync.com/i/175/9.gif
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.95.33.120 , Germany, ASN16276 (OVH, FR),
Reverse DNS
ns3203256.ip-141-95-33.eu
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type
image/gif;charset=UTF-8
date
Wed, 29 Nov 2023 15:43:07 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p
CP="CAO PSA OUR"
tap.php
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://sid.storygize.net/ccm/729e4e94-63c3-438d-8ce4-184eb34e703f
  • https://pixel.rubiconproject.com/tap.php?v=1172318&nid=5570&put=37cf273d-6031-4a9e-b4c2-17b86d952301
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=1172318&nid=5570&put=37cf273d-6031-4a9e-b4c2-17b86d952301
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=1172318&nid=5570&put=37cf273d-6031-4a9e-b4c2-17b86d952301
date
Wed, 29 Nov 2023 15:43:07 GMT
content-length
0
tap.php
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=64
  • https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=5107433831282994715&expires=30
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=5107433831282994715&expires=30
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
402fba8a82f093def2459220061c8d31
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=5107433831282994715&expires=30
Date
Wed, 29 Nov 2023 15:43:07 GMT
Server
Jetty(9.4.51.v20230217)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
getuid
sync.smartadserver.com/ Frame 8C0D
Redirect Chain
  • https://sync.smartadserver.com/getuid?gdpr=0&url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D32128%26nid%3D2915%26put%3D[sas_uid]
  • https://sync.smartadserver.com/getuid?gdpr=0&url=https://pixel.rubiconproject.com/tap.php?v=32128&nid=2915&put=[sas_uid]&cklb=1
0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.smartadserver.com/getuid?gdpr=0&url=https://pixel.rubiconproject.com/tap.php?v=32128&nid=2915&put=[sas_uid]&cklb=1
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
81.17.55.172 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
content-length
0

Redirect headers

location
https://sync.smartadserver.com:443/getuid?gdpr=0&url=https://pixel.rubiconproject.com/tap.php?v=32128&nid=2915&put=[sas_uid]&cklb=1
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:06 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
tap.php
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://dmp.brand-display.com/cm/api/rubicon
  • https://pixel.rubiconproject.com/tap.php?v=538100&nid=5446&put=8cc7d1e1-12b3-b56f-4c073297
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=538100&nid=5446&put=8cc7d1e1-12b3-b56f-4c073297
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 google
server
nginx/1.24.0
p3p
CP='This is not a P3P policy!'
access-control-allow-origin
*
location
https://pixel.rubiconproject.com/tap.php?v=538100&nid=5446&put=8cc7d1e1-12b3-b56f-4c073297
content-type
text/html; charset=utf-8
cache-control
max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
121
tap.php
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://onetag-sys.com/match/?int_id=4
  • https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=
strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
CookieSyncRubicon
rtb.adentifi.com/ Frame 8C0D 		0
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.adentifi.com/CookieSyncRubicon
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.188.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-188-147.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:07 GMT
tap.php
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://sync.adotmob.com/cookie/rubicon?r=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D123034%26nid%3D3956%26put%3D%7Buser_token%7D
  • https://pixel.rubiconproject.com/tap.php?v=123034&nid=3956&put=09db220400841804b79b2b59&expires=1
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=123034&nid=3956&put=09db220400841804b79b2b59&expires=1
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=123034&nid=3956&put=09db220400841804b79b2b59&expires=1
date
Wed, 29 Nov 2023 15:43:12 GMT
access-control-allow-credentials
true
x-powered-by
Express
keep-alive
timeout=5
vary
Origin
content-length
0
token
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/rb.gif
  • https://pixel.rubiconproject.com/tap.php?v=711370&nid=5504&put=7bc850e3-be78-4ae0-a1cc-36d2632af28c&expires=365&next=https%3A%2F%2Fbeacon.lynx.cognitivlabs.com%2Fpixel%3Ftype%3Dsync%26source%3Drubi...
  • https://beacon.lynx.cognitivlabs.com/pixel?type=sync&source=rubicon&inventory_source=0
  • https://pixel.rubiconproject.com/token?pid=49038&puid=7bc850e3-be78-4ae0-a1cc-36d2632af28c
0
492 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/token?pid=49038&puid=7bc850e3-be78-4ae0-a1cc-36d2632af28c
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Expires
0
Pragma
no-cache
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/token?pid=49038&puid=7bc850e3-be78-4ae0-a1cc-36d2632af28c
Date
Wed, 29 Nov 2023 15:43:08 GMT
Server
Kestrel
Connection
keep-alive
Content-Length
0
ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 8C0D 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=54
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.88.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-13.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
tap.php
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://rubiconcm.digitaleast.mobi/usersync/rubicon.gif
  • https://pixel.rubiconproject.com/tap.php?v=600424&nid=5498&put=04c563ba-b4b3-421f-ac65-2dadcc3f07a0
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=600424&nid=5498&put=04c563ba-b4b3-421f-ac65-2dadcc3f07a0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=600424&nid=5498&put=04c563ba-b4b3-421f-ac65-2dadcc3f07a0
date
Wed, 29 Nov 2023 15:43:07 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
130
content-type
text/html; charset=utf-8
tap.php
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://um4.eqads.com/um/rc
  • https://pixel.rubiconproject.com/tap.php?v=11598&nid=2494&put=f9aac181-5916-4a6c-8bfe-4da28fe814aa&expires=30
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=11598&nid=2494&put=f9aac181-5916-4a6c-8bfe-4da28fe814aa&expires=30
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=11598&nid=2494&put=f9aac181-5916-4a6c-8bfe-4da28fe814aa&expires=30
date
Wed, 29 Nov 2023 15:43:08 GMT
cache-control
no-cache
content-length
0
expires
0
tap.php
pixel.rubiconproject.com/ Frame 8C0D
Redirect Chain
  • https://cm.smadex.com/sync?sm_p=rbc&sm_r=rbc
  • https://pixel.rubiconproject.com/tap.php?v=71194&nid=3636&put=2cb3d839-a303-43e0-8534-af27e78e4830&expires=30
42 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=71194&nid=3636&put=2cb3d839-a303-43e0-8534-af27e78e4830&expires=30
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
e8e3ec71b160ae7345e4e302cc752a77
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=71194&nid=3636&put=2cb3d839-a303-43e0-8534-af27e78e4830&expires=30
date
Wed, 29 Nov 2023 15:43:08 GMT
via
1.1 fd4a06b35c482e680f7f3fd9baaa0090.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
x-amz-cf-id
aL8OfcjLB23Yw8A46FXHz0KzJlckX9Dcy9sdfd4loQ2KWhqrMF3udQ==
x-cache
Miss from cloudfront
72731
idx.liadm.com/idex/unknown/ 		0
375 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://idx.liadm.com/idex/unknown/72731?duid=57b4458eb59c--01hgdvz2xx52zhtpkasf60wjrm&resolve=md5
Requested by
Host: b-code.liadm.com
URL: https://b-code.liadm.com/lc2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.17.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-17-205.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin
request-time
2
access-control-allow-origin
https://www.theepochtimes.com
cache-control
max-age=3599, private
access-control-allow-credentials
true
trace-id
5e6f797454c6f65b
expires
Wed, 29 Nov 2023 16:43:08 GMT
pixel;r=1657426756;rf=0;a=p-a128V7tctPVtT;url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489;uht=2;fpan=1;fpa=P0-153325437-1701272587518;pbc=;ns=0;ce=1;qjs=1;qv=...
pixel.quantserve.com/ 		35 B
210 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=1657426756;rf=0;a=p-a128V7tctPVtT;url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489;uht=2;fpan=1;fpa=P0-153325437-1701272587518;pbc=;ns=0;ce=1;qjs=1;qv=6076e8c2-20231114150359;cm=;gdpr=0;ref=;d=theepochtimes.com;dst=1;et=1701272587941;tzo=-60;ogl=title.Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%2Cdescription.Play%20online%20Spot%20the%20Difference%20Daily%20game%20%252EPlay%20now%20for%20free%252C%20no%20download%20or%20re%2Curl.https%3A%2F%2Fwww%252Etheepochtimes%252Ecom%2Fepochfun%2Fspot-the-difference-daily-3956489%2Csite_name.The%20Epoch%20Times%2Clocale.en-US%2Cimage.https%3A%2F%2Fimg%252Etheepochtimes%252Ecom%2Fassets%2Fuploads%2F2023%2F07%2F21%2Fid5414540-EET-logo%252Epng%2Ctype.website;ses=8f41fe88-b1b8-4cf4-a403-25b9f5a1e942;mdl=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:e365:4988:e8a7:3270 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
strict-transport-security
max-age=86400
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
/
tags.wdsvc.net/tpc-eval/ 		21 B
284 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.wdsvc.net/tpc-eval/?lid=18c1bbf8e68-tags8-69dbce70dd05d
Requested by
Host: tags.wdsvc.net
URL: https://tags.wdsvc.net/controller.js?id=100415
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.202.83.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-202-83-199.compute-1.amazonaws.com
Software
/
Resource Hash
b0e70b299ab9c122ad93531fa8e5309833baecd53dd55c992c538f8b33bfa22d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:08 GMT
Content-Type
text/javascript
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Keep-Alive
timeout=5
Content-length
21
Expires
Mon, 3 Jan 2005 13:00:00 GMT
p.gif
p.alocdn.com/c/6irth52s/a/etarget/
Redirect Chain
  • https://p.alocdn.com/c/6irth52s/a/etarget/p.gif?title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.co...
  • https://p.alocdn.com/c/6irth52s/a/etarget/p.gif?title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.co...
42 B
351 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.alocdn.com/c/6irth52s/a/etarget/p.gif?title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&auid=a634b748-2bfc-4ac8-9408-aee689913aec&tdc=1
Protocol
H2
Server
35.163.158.243 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-163-158-243.us-west-2.compute.amazonaws.com
Software
nginx/1.20.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
date
Wed, 29 Nov 2023 15:43:08 GMT
server
nginx/1.20.1
content-type
image/GIF

Redirect headers

location
/c/6irth52s/a/etarget/p.gif?title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&auid=a634b748-2bfc-4ac8-9408-aee689913aec&tdc=1
date
Wed, 29 Nov 2023 15:43:08 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
server
nginx/1.20.1
content-type
image/GIF
2f1a1223-5459-4de2-b65b-ac0656ebee0b
https://securegames.iwin.com/ Frame C830 		251 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/2f1a1223-5459-4de2-b65b-ac0656ebee0b
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9679406bfb3bdcbd74652282dd7257f1325ce1ed069d80e3cba9244ba1919dca

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
257266
Content-Type
image/jpeg
logo.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		7 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/logo.png
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
a26f2837af50af431970d8d6c86ab1f2354b33258517cfed4e75c3b9eae272fa

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 16 Nov 2023 17:09:15 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
1118033
ETag
"2917151474"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
6935
X-Amz-Cf-Id
hn0MyEpOWxwuoCoS-Wm2YgOtYreoqFrSSx3TFTaTlNHVvTgebfB4ow==
Expires
Fri, 15 Nov 2024 17:09:15 GMT
p.gif
p.alocdn.com/c/vn3d8u2u/a/etarget/
Redirect Chain
  • https://p.alocdn.com/c/vn3d8u2u/a/etarget/p.gif?label=5N0H11N-collect-%257B%2522script%2522%253A%2522https%253A%252F%252Fs3-us-west-2.amazonaws.com%252Fjsstore%252Fa%252F5n0h11n%252Fge.js%2522%252C...
  • https://p.alocdn.com/c/vn3d8u2u/a/etarget/p.gif?label=5N0H11N-collect-%257B%2522script%2522%253A%2522https%253A%252F%252Fs3-us-west-2.amazonaws.com%252Fjsstore%252Fa%252F5n0h11n%252Fge.js%2522%252C...
42 B
351 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.alocdn.com/c/vn3d8u2u/a/etarget/p.gif?label=5N0H11N-collect-%257B%2522script%2522%253A%2522https%253A%252F%252Fs3-us-west-2.amazonaws.com%252Fjsstore%252Fa%252F5n0h11n%252Fge.js%2522%252C%2522ver%2522%253A%25221.6.1%2522%252C%2522guid%2522%253A%2522021f82a7-7f5e-4152-9436-2d1f2f09c23c%2522%257D&title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tdc=1
Protocol
H2
Server
35.163.158.243 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-163-158-243.us-west-2.compute.amazonaws.com
Software
nginx/1.20.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
date
Wed, 29 Nov 2023 15:43:08 GMT
server
nginx/1.20.1
content-type
image/GIF

Redirect headers

location
/c/vn3d8u2u/a/etarget/p.gif?label=5N0H11N-collect-%257B%2522script%2522%253A%2522https%253A%252F%252Fs3-us-west-2.amazonaws.com%252Fjsstore%252Fa%252F5n0h11n%252Fge.js%2522%252C%2522ver%2522%253A%25221.6.1%2522%252C%2522guid%2522%253A%2522021f82a7-7f5e-4152-9436-2d1f2f09c23c%2522%257D&title=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&url=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&tdc=1
date
Wed, 29 Nov 2023 15:43:08 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
server
nginx/1.20.1
content-type
image/GIF
cms-2-rubicon.min.js
cti.w55c.net/ct/ Frame F3C8 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cti.w55c.net/ct/cms-2-rubicon.min.js
Requested by
Host: cti.w55c.net
URL: https://cti.w55c.net/ct/cms-2c-rubicon.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.88.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-88-104.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5c7987d2f26ca9bf8254df658877b74005f2e90d3f477eacc606e011341d8082
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cti.w55c.net/ct/cms-2c-rubicon.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
4wUy6FG8mI1tQq9b3POfj8uoA5V85xC6
content-encoding
br
via
1.1 04033844f25f5e47de102de77d8b5f4c.cloudfront.net (CloudFront)
date
Tue, 28 Nov 2023 15:56:37 GMT
strict-transport-security
max-age=2592000; includeSubDomains
x-amz-cf-pop
MUC50-C1
age
344057
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Fri, 17 Sep 2021 21:17:39 GMT
server
AmazonS3
etag
W/"d7ff0f4ef590b94bd79fc9b61a13ef4e"
vary
Accept-Encoding
content-type
application/javascript
cache-control
must-revalidate
x-amz-cf-id
t9oJEPoop2JowsDkglxs1Jef3Fflnniv2Ubtaqkxgc_h1ao-9q35DQ==
d9dd5ac3-cfd6-4a2b-b535-dd8c533f74a2
https://securegames.iwin.com/ Frame C830 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/d9dd5ac3-cfd6-4a2b-b535-dd8c533f74a2
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a26f2837af50af431970d8d6c86ab1f2354b33258517cfed4e75c3b9eae272fa

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
6935
Content-Type
image/png
buttonHint.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		7 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/buttonHint.png
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
6b54ccbabc5f2cc35faa1530cdce7e38e6344d207975ae21182db4a476a4e369

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 13:13:47 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6056961
ETag
"1625305466"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
6778
X-Amz-Cf-Id
RhiIoMsaKNg2DM_qwtttnqlo7A4BDp4IcIrCFSeHthcjqxY71TaC6g==
Expires
Thu, 19 Sep 2024 13:13:47 GMT
clarity.js
www.clarity.ms/s/0.7.18/ 		59 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/s/0.7.18/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/138003605
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f4e16c137bfcf443839c20e1038b9ee2dec570f047ae3b1c8f9378e9176750dd

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
content-encoding
br
last-modified
Fri, 17 Nov 2023 13:41:44 GMT
x-azure-ref-originshield
0qXNmZQAAAACjP/Eqrdm3QKad+0oC22I+RlJBMjMxMDUwNDE3MDA5ADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
etag
"0x8DBE772F014B026"
x-azure-ref
0DFxnZQAAAAACWpDcTYJtRZbulbKQNqqyWlJIRURHRTA2MTIANmNmYmVlZTAtNTAyNy00ODRiLTg5NjctNGEyOWFmNzdmMWUx
x-cache
TCP_HIT
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
x-ms-request-id
56795ca0-a01e-005f-5203-229ae7000000
cache-control
public, max-age=86400
x-ms-version
2018-03-28
accept-ranges
bytes
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=52A27B8A52C340B9933BA603A3F847EF&RedC=c.clarity.ms&MXFR=3325B116AB7D682B3537A2CEAF7D66C4
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=52A27B8A52C340B9933BA603A3F847EF&MUID=0C206B455AD768603F6F789D5B8C69FF
42 B
444 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=52A27B8A52C340B9933BA603A3F847EF&MUID=0C206B455AD768603F6F789D5B8C69FF
Protocol
H2
Server
68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:07 GMT
last-modified
Wed, 30 Aug 2023 19:01:41 GMT
server
Microsoft-IIS/10.0
etag
"8d59566974dbd91:0"
x-powered-by
ASP.NET
content-type
image/gif
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-length
42

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:08 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B4570B5E894E4174AFADD145C6D98382 Ref B: ZRHEDGE1910 Ref C: 2023-11-29T15:43:08Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=52A27B8A52C340B9933BA603A3F847EF&MUID=0C206B455AD768603F6F789D5B8C69FF
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
match-result
tags.w55c.net/ Frame F3C8
Redirect Chain
  • https://pm.w55c.net/m.gif?rurl=//cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=_wfivefivec64esc_&google_cm
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=b0RqeHFoWHExUjhtSXI1&google_cm
  • https://tags.w55c.net/match-result?id=8bb138bc0446417c9a4df9a0136d0caf8a93328592bf4d059bfc856c256fbc33&ei=GOOGLE&euid=&google_gid=CAESEJFtejrTUPNl2fU4Rw3MRBc&google_cver=1
42 B
752 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.w55c.net/match-result?id=8bb138bc0446417c9a4df9a0136d0caf8a93328592bf4d059bfc856c256fbc33&ei=GOOGLE&euid=&google_gid=CAESEJFtejrTUPNl2fU4Rw3MRBc&google_cver=1
Requested by
Host: cti.w55c.net
URL: https://cti.w55c.net/ct/cms-2c-rubicon.html
Protocol
HTTP/1.1
Server
52.57.12.239 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-12-239.eu-central-1.compute.amazonaws.com
Software
Retargeting/v2.0.30-795-gb641a57#rel-ec2-master i-029f22d856dc4e10e@eu-central-1a@dxedge-app-eu-central-1-prod-asg /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cti.w55c.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 29 Nov 2023 15:43:08 GMT
Strict-Transport-Security
max-age=2592000; includeSubDomains
Server
Retargeting/v2.0.30-795-gb641a57#rel-ec2-master i-029f22d856dc4e10e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type,X-Forwarded-Proto
Content-Length
42
Expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:08 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://tags.w55c.net/match-result?id=8bb138bc0446417c9a4df9a0136d0caf8a93328592bf4d059bfc856c256fbc33&ei=GOOGLE&euid=&google_gid=CAESEJFtejrTUPNl2fU4Rw3MRBc&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
384
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
2964
tags.bluekai.com/site/ Frame F3C8 		62 B
426 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.bluekai.com/site/2964?id=oDjxqhXq1R8mIr5
Requested by
Host: cti.w55c.net
URL: https://cti.w55c.net/ct/cms-2c-rubicon.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a69-192-160-219.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cti.w55c.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date
Wed, 29 Nov 2023 15:43:08 GMT
content-length
62
content-type
image/gif
7ad012a5-cd58-4f38-881c-5220e34b02eb
https://securegames.iwin.com/ Frame C830 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/7ad012a5-cd58-4f38-881c-5220e34b02eb
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6b54ccbabc5f2cc35faa1530cdce7e38e6344d207975ae21182db4a476a4e369

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
6778
Content-Type
image/png
buttonPause.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		4 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/buttonPause.png
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
45c45e2bb16ed0d3ff8fecc46f36a5f3645040b3b5b7f8cca6abf2699dba78fd

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 12 Sep 2023 12:44:48 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6749900
ETag
"1365266366"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
3772
X-Amz-Cf-Id
h8NCuXPkCwjBZCQJVjmOl3jx7asr_IBGbXQN5Xi9TLewgsgcvF2m9w==
Expires
Wed, 11 Sep 2024 12:44:48 GMT
78e7a09b-db42-4101-9762-e64763bf76dd
https://securegames.iwin.com/ Frame C830 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/78e7a09b-db42-4101-9762-e64763bf76dd
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
45c45e2bb16ed0d3ff8fecc46f36a5f3645040b3b5b7f8cca6abf2699dba78fd

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
3772
Content-Type
image/png
buttonPlay.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		25 KB
26 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/buttonPlay.png
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
1e23d5ae57d4c28be6a24923ee2e15d27739e59c99bf88b65ec0aea1eca7697e

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 12 Sep 2023 12:44:48 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6749900
ETag
"3960945357"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
26080
X-Amz-Cf-Id
Z9kkPjEajc_VWdsNITKuRN29HZHCuZAN5XbsXmLVy9t8CHDQKI_N4g==
Expires
Wed, 11 Sep 2024 12:44:48 GMT
collect
o.clarity.ms/ 		0
301 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://o.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.18/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.152.143.207 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.theepochtimes.com
Date
Wed, 29 Nov 2023 15:43:08 GMT
Access-Control-Allow-Credentials
true
Server
nginx/1.18.0 (Ubuntu)
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
746e2841-1cdb-4ce2-ab8e-f99f3be4600d
https://securegames.iwin.com/ Frame C830 		25 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/746e2841-1cdb-4ce2-ab8e-f99f3be4600d
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1e23d5ae57d4c28be6a24923ee2e15d27739e59c99bf88b65ec0aea1eca7697e

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
26080
Content-Type
image/png
buttonAudio.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		5 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/buttonAudio.png
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
7456ca7a60534034ee65b33ca59fb5fe7e0cc74a5a981967508be6496a58b642

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 12 Sep 2023 12:44:49 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6749899
ETag
"4116968718"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
5541
X-Amz-Cf-Id
35O7gQtp3LC9-WpkEOwln2Rw_SilYhbVTbAckJ7BvJklSIFlPvYRUg==
Expires
Wed, 11 Sep 2024 12:44:49 GMT
1ef56d73-1764-484f-9362-b53845cceb6b
https://securegames.iwin.com/ Frame C830 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/1ef56d73-1764-484f-9362-b53845cceb6b
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7456ca7a60534034ee65b33ca59fb5fe7e0cc74a5a981967508be6496a58b642

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
5541
Content-Type
image/png
article19.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		3 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/article19.png
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
fa1b185ed81ddd10ecddbdc522846d6b71b0023d4603929fd8b9e2538a7ede5a

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 12 Sep 2023 12:44:49 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6749899
ETag
"1635796090"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
2851
X-Amz-Cf-Id
JerskQWLjvz_fkH6bivXSEcxl8QQDNw6GFmiDNZNknNZP4tbTVfCag==
Expires
Wed, 11 Sep 2024 12:44:49 GMT
5d2d74a7-9f7d-4a88-9431-631d0dd84786
https://securegames.iwin.com/ Frame C830 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/5d2d74a7-9f7d-4a88-9431-631d0dd84786
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fa1b185ed81ddd10ecddbdc522846d6b71b0023d4603929fd8b9e2538a7ede5a

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
2851
Content-Type
image/png
mag.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		3 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/mag.png
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
e59c8d560fff71627a3526971a9cf1d128c2024f6075d8863d2f15030d31597c

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 13 Sep 2023 07:19:41 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6683007
ETag
"3519251542"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
3103
X-Amz-Cf-Id
M3bm0H_KwESF7d7wEpYBVU5je4LBzu_PsLYbFg5RXVThI9syP0zByA==
Expires
Thu, 12 Sep 2024 07:19:41 GMT
8d377e92-d84b-41b0-9e16-23604999faaf
https://securegames.iwin.com/ Frame C830 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/8d377e92-d84b-41b0-9e16-23604999faaf
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e59c8d560fff71627a3526971a9cf1d128c2024f6075d8863d2f15030d31597c

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
3103
Content-Type
image/png
AvenirLtStdBg.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		49 KB
49 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdBg.png?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
5558beabf2d2b02f4f29c9a5588e064bd7014334dcfb104f34a7535b38348856

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 May 2023 06:26:39 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
17140589
ETag
"3429029083"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
49933
X-Amz-Cf-Id
DjXgmmxp3aaCwgcC17CS5wROECvGJzMovP_tBNC1B9_WucTI7iUK7g==
Expires
Tue, 14 May 2024 06:26:39 GMT
47a76397-e814-425a-8c98-678d31766221
https://securegames.iwin.com/ Frame C830 		49 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/47a76397-e814-425a-8c98-678d31766221
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5558beabf2d2b02f4f29c9a5588e064bd7014334dcfb104f34a7535b38348856

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
49933
Content-Type
image/png
AvenirLtStdBg.xml
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		8 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdBg.xml?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
fba79dbbefb3bc0ec989cc661e83bbe57f25e50c2df1b9640711520a240cf18e

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 13 Sep 2023 05:54:38 GMT
Content-Encoding
gzip
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
6688110
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1236
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"2781060308+gzip"
Vary
Accept-Encoding
Content-Type
text/xml
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
fW1K1vzbl-5CqwlGNJ_8Cvp9jKdT2s3kpJLoScorZFFgVngriQSIFA==
Expires
Thu, 12 Sep 2024 05:54:38 GMT
AvenirLtStdMd.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		24 KB
25 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdMd.png?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
ca36edebedff418d8315a73c89adadf5c2857af4421a201304cbd2ba550159a1

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 07 Sep 2023 08:31:41 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
7197087
ETag
"2556739421"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
24706
X-Amz-Cf-Id
ZND8FTdZAsEbppeYZg27NxIPk8gUHugdA-BHOExTh78h07d_wGxrbQ==
Expires
Fri, 06 Sep 2024 08:31:41 GMT
520b175d-41a2-435e-96d8-2029bd273a0d
https://securegames.iwin.com/ Frame C830 		24 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/520b175d-41a2-435e-96d8-2029bd273a0d
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca36edebedff418d8315a73c89adadf5c2857af4421a201304cbd2ba550159a1

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
24706
Content-Type
image/png
AvenirLtStdMd.xml
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		8 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdMd.xml?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
801be445b05c75fe0501cb5ebe6c9d308855fa4465923f8372389bbda6854c24

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 24 May 2023 01:27:44 GMT
Content-Encoding
gzip
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
16380924
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1151
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"836769662"
Vary
Accept-Encoding
Content-Type
text/xml
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
6kEGcF7qEPTiTmZzDusQsthirojeP7t7imd8Q7Zx13bWFBaEHjG4bA==
Expires
Thu, 23 May 2024 01:27:44 GMT
AvenirLtStdSm.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		17 KB
17 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdSm.png?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
85648cea277f5e1dc4d97ae8a6e6417500a3b4a5c8ebea89acd7bb4bb89277ed

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 07 Sep 2023 08:31:42 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
7197086
ETag
"1947480727"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
17150
X-Amz-Cf-Id
QsZzGENH9x2PFJ6KS4VBLuVxA8r_lyXPI6eZZUGdC4PvV9DrDwbmjg==
Expires
Fri, 06 Sep 2024 08:31:42 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 19C1 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsspACVJUR4NGHiAT5Q2T_fGwjR1EpPkC2kLW4GQPZv-CEFlSk3DZvNZ0hfsfuYjb41aAMkG4wapUEi27msFh36VcF59dHFKKF3rjXxTIcPafi3Y6QYF3fUSD3ys3LLKef23Nn87Y2_nFys33PN74DUVO4dAscOtBmkcJQhIciAvOM7wbvatSQRzAE4348ieTC9qSbVqFAYOmzrb31FghR13btaZSANuwEsDs2r4FH-qay2MlvdUNzVJPZFDmIDuGzocbmtRhFl9ohtpsa_ZW9qJwHXkSt7v1MnYRYLNqgeUuDc-w378-DBY6nyb-qcadX08wwPD_eXNlvZWWQlMz3xrdJDH3_l_XTxMeggtgoCQm1Qx1CJzyxS2kKNrgWmfMPGW&sai=AMfl-YT4o-vx_0T3sKHsEwNEVKuoWXfm-XupEcVQnZr3dLvmzeClf2_58Wi2Ja6LxQtHE1mapuSmQG3L3fTkoMNAgHmzAwaUN79CkqXV5uiKePJrBeXZocMJUlKWkKt4DMeKyWynHqPjdNrb-Q&sig=Cg0ArKJSzI3Qg32UrluKEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:08 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Wed, 29 Nov 2023 15:43:08 GMT
truncated
/ Frame 19C1 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5141d00d7542330143ed512b1bf5549cdd368bf99010fef0f56765818c716ab3

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 19C1 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1d9e0d05669a3610c7263c551b8b406344c148713485f7e8124f61b05e2463cd

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
init
gw.geoedge.be/api/ 		0
215 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gw.geoedge.be/api/init
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.93.134 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-93-134.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
date
Wed, 29 Nov 2023 15:43:08 GMT
via
1.1 14930ca61b5acb472c19a8d7b170ad10.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
LUusZt4fDxWfwnQUDlR2r67NYhwcfIbiDeBqoMlRZZcZ5Oz1g6k99g==
x-cache
Miss from cloudfront
report
gw.geoedge.be/api/ 		0
215 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gw.geoedge.be/api/report
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.93.134 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-93-134.muc50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
date
Wed, 29 Nov 2023 15:43:08 GMT
via
1.1 14930ca61b5acb472c19a8d7b170ad10.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
content-length
0
x-amz-cf-id
b5yZ3sFLOp92wLb2DFippEGRAU4x3-BtQnOutTgrNfyNrpESyIibhw==
x-cache
Miss from cloudfront
69242e08-5561-4d5a-87c7-6e281726baf8
https://securegames.iwin.com/ Frame C830 		17 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/69242e08-5561-4d5a-87c7-6e281726baf8
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
85648cea277f5e1dc4d97ae8a6e6417500a3b4a5c8ebea89acd7bb4bb89277ed

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
17150
Content-Type
image/png
AvenirLtStdSm.xml
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		8 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdSm.xml?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
aa3eceebc8782791570f46b1442057bf2abefca9f78f1c8811bbe7cc43f3616d

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 27 Sep 2023 05:44:40 GMT
Content-Encoding
gzip
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
5479108
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1112
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"3842235718+gzip"
Vary
Accept-Encoding
Content-Type
text/xml
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
y8MvBF4t3iMpxT3N-bE0VlZ1AJ3hzayxhcCo7vqUMR-uKWJPxAwHcA==
Expires
Thu, 26 Sep 2024 05:44:40 GMT
AvenirLtStdNm.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		7 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdNm.png?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
ca85bd4aef40ae9050a93ad6b0c2f5632a7f29629c9ca59cdaf591f4f2789515

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 19 May 2023 20:47:00 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
16743368
ETag
"3584290376"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
6873
X-Amz-Cf-Id
rEYuWjdjEHlq0AOuVTi_yqg6O8BWA8c9Im1nwCtLfZuqVtuPCKWgdA==
Expires
Sat, 18 May 2024 20:47:00 GMT
3b2d2ca4-6639-4785-a1db-35e389c2e1bc
https://securegames.iwin.com/ Frame C830 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/3b2d2ca4-6639-4785-a1db-35e389c2e1bc
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca85bd4aef40ae9050a93ad6b0c2f5632a7f29629c9ca59cdaf591f4f2789515

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
6873
Content-Type
image/png
AvenirLtStdNm.xml
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		2 KB
1002 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdNm.xml?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
ac44c50f0d84fdc26c60b8ce8bb8b4d30f10b31a0c877ee30ca1d0350483b6c4

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 07 Sep 2023 06:55:01 GMT
Content-Encoding
gzip
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
7202887
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
429
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"2235798992"
Vary
Accept-Encoding
Content-Type
text/xml
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
KYaHi_3r4rV3y9HO9VaFzpmJPx8INiTuama7aVQvFVC4vcbIVgzMQw==
Expires
Fri, 06 Sep 2024 06:55:01 GMT
AvenirLtStdOb.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		9 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdOb.png?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
114f982584c95ba0b5a06f8b47f9117481552b142ef0b82de888f80265975380

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 12 Sep 2023 00:21:23 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6794505
ETag
"1639978102"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
8831
X-Amz-Cf-Id
9O6T7tS3s6vT7-8029igMGsl1JqhjY13ATJl5J8qvmB6QxO-86VsXQ==
Expires
Wed, 11 Sep 2024 00:21:23 GMT
0801bf5a-4c09-4e1e-bf0c-91aa23e9ca37
https://securegames.iwin.com/ Frame C830 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/0801bf5a-4c09-4e1e-bf0c-91aa23e9ca37
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
114f982584c95ba0b5a06f8b47f9117481552b142ef0b82de888f80265975380

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
8831
Content-Type
image/png
AvenirLtStdOb.xml
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/AvenirLtStdOb.xml?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
fc216de5b5c2b370f0301381961e4223dfa533b4bfe7f7bd529a4d2140697169

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 29 Sep 2023 05:34:58 GMT
Content-Encoding
gzip
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
5306890
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
561
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"3045313742+gzip"
Vary
Accept-Encoding
Content-Type
text/xml
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes, bytes
X-Amz-Cf-Id
EeYMmve3D_N4sO-FOn-1ymCjbSycpsUtMKGaXBlSIorP-QduiPITuw==
Expires
Sat, 28 Sep 2024 05:34:58 GMT
Plus.png
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		8 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/Plus.png?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
c7d12e0bbcb4b4ffa36b2c6539d36c3f3fbd694c0025c75cbc4174fdf500cbfd

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 19 Sep 2023 20:00:52 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6118936
ETag
"3034818066"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
7825
X-Amz-Cf-Id
LxL3GxagR0hvIEUngrPgyO7iVXO2oGR5tN_e69tAUW7fg42j9cV6fg==
Expires
Wed, 18 Sep 2024 20:00:52 GMT
606706ab-fb69-4f8d-ba05-72daa8d7db62
https://securegames.iwin.com/ Frame C830 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://securegames.iwin.com/606706ab-fb69-4f8d-ba05-72daa8d7db62
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c7d12e0bbcb4b4ffa36b2c6539d36c3f3fbd694c0025c75cbc4174fdf500cbfd

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
7825
Content-Type
image/png
Plus.xml
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/ Frame C830 		1003 B
941 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/hd/Plus.xml?1701272587147
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
81a0f3f83585c0223a44bc099e0d6ae756c970a831e9f56b1154e1dc8638f2ed

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 29 Sep 2023 05:34:59 GMT
Content-Encoding
gzip
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
MUC50-P4
Age
5306889
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
385
Last-Modified
Mon, 05 Jun 2017 11:20:08 GMT
ETag
"1101028976+gzip"
Vary
Accept-Encoding
Content-Type
text/xml
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
8eZlxrvLD1MKVuLUT0Qg6AZrlti0Qn9tOBVRXZWjI9ptiR3C4P2Www==
Expires
Sat, 28 Sep 2024 05:34:59 GMT
silence.ogg
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/ Frame C830 		4 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/silence.ogg
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
7c6f17e7a639b998b35fa6e575eb805e6efda2789431bd4c30ab2c46bd2345ec

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 28 Nov 2023 02:47:16 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:07 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
132952
ETag
"4051704580"
X-Cache
Hit from cloudfront
Content-Type
application/ogg
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
3981
X-Amz-Cf-Id
ta78F1SmmvXBn0fsbNvEuFoaezlY__lOAmCZQ7T_HtSX-aOZmzt1Wg==
Expires
Wed, 27 Nov 2024 02:47:16 GMT
button.ogg
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/ Frame C830 		5 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/button.ogg
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
7760469d02e7957e9a0d0d75a1822cc92d28e7960c8687dfa93401051f83e316

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 13 Nov 2023 06:42:31 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:07 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
1414837
ETag
"2030286260"
X-Cache
Hit from cloudfront
Content-Type
application/ogg
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
5119
X-Amz-Cf-Id
9_INXUibXEYAzbMOQ2sQwJPlWefsQzYoE3MDiUY4l_ITzy8q9I3d0g==
Expires
Tue, 12 Nov 2024 06:42:31 GMT
pos.ogg
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/ Frame C830 		14 KB
15 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/pos.ogg
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
afe63612de0976860ecee1a6a56bbaff6f9ac77530f878fe0c8749b9c3b50933

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 22 Sep 2023 08:20:00 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:07 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
5901789
ETag
"2288500273"
X-Cache
Hit from cloudfront
Content-Type
application/ogg
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
14566
X-Amz-Cf-Id
Jr7H3WNh3mg0W0UfJxy8sG52sAdqGeOEv_qoDb2dk3dyjjt6IXR0Bw==
Expires
Sat, 21 Sep 2024 08:20:00 GMT
neg.ogg
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/ Frame C830 		7 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/neg.ogg
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
6babdf3822ebdb78bab5319520dbf63865612e8fad397d858543cdad32dc5ff5

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 09 Oct 2023 06:50:14 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:07 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
4438375
ETag
"3372478440"
X-Cache
Hit from cloudfront
Content-Type
application/ogg
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
6972
X-Amz-Cf-Id
DSCk3uM7mJQD2nCAylOe-gaMXRy3JE4TSwhICIU1Lm1zvoUFy2UmHA==
Expires
Tue, 08 Oct 2024 06:50:14 GMT
solved.ogg
securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/ Frame C830 		14 KB
15 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/assets/audio/solved.ogg
Requested by
Host: securegames.iwin.com
URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-86.muc50.r.cloudfront.net
Software
/
Resource Hash
a03c03253413f46b99793ec18c78422e09a821d32b32d835e5946c149cb38c66

Request headers

Referer
https://securegames.iwin.com/m/uclick/spotthedifference/v_8/
X-Requested-With
XMLHttpRequest
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 13:13:52 GMT
Via
1.1 541abc390c35db77f7d121c96f0661ec.cloudfront.net (CloudFront)
Last-Modified
Mon, 05 Jun 2017 11:20:07 GMT
X-Amz-Cf-Pop
MUC50-P4
Age
6056957
ETag
"4229179951"
X-Cache
Hit from cloudfront
Content-Type
application/ogg
Cache-Control
public, max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes, bytes
Content-Length
14499
X-Amz-Cf-Id
0At_PrZLwj7VULi__OuQoCpz3jx5BSJdJs5Di_X8DRRZGYFAYsEshg==
Expires
Thu, 19 Sep 2024 13:13:52 GMT
/
mixproxy.epoch.cloud/mixpanel/track/ 		1 B
589 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mixproxy.epoch.cloud/mixpanel/track/?ip=1&_=1701272589140
Requested by
Host: mixproxy.epoch.cloud
URL: https://mixproxy.epoch.cloud/mixpanel/lib.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e6::ac40:cb07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=604800; includeSubDomains

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Wed, 29 Nov 2023 15:43:09 GMT
strict-transport-security
max-age=604800; includeSubDomains
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time
19
alt-svc
h3=":443"; ma=86400
content-length
1
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.theepochtimes.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5HKnd6Jj58Qb1JR3gTz6TuhxV4mRvuLXYgbfwl%2FEXs6Vqe4QL7XdPkuWpLhTgqz%2Fs%2Fok%2FT%2BasEa5WQ4wO9Zxa9D2QdqwuMiwGbior9CcYei040bu8Kie9yaz4JGhZJEvjTMut2GgXrB0y2%2Fak4hGT0HKvA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
X-MP-CE-Backoff
cache-control
no-cache, no-store
access-control-allow-credentials
true
cf-ray
82dbf6f228370e2b-MXP
access-control-allow-headers
X-Requested-With
c
ea.epochbase.com/api/pw/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://ea.epochbase.com/api/pw/c?tid=P-KDJOIELE2&en=readactivity
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
4.7.168.74 White Haven, United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.theepochtimes.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Access-Control-Allow-Origin,Content-Type
access-control-allow-methods
GET, POST, PATCH, OPTIONS, PUT, DELETE
access-control-allow-origin
*
allow
GET, POST, OPTIONS, PUT, DELETE
content-length
0
date
Wed, 29 Nov 2023 15:43:09 GMT
server
nginx/1.20.1
c
ea.epochbase.com/api/pw/ 		0
232 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ea.epochbase.com/api/pw/c?tid=P-KDJOIELE2&en=readactivity
Requested by
Host: subs.theepochtimes.com
URL: https://subs.theepochtimes.com/lib/api.bundle.js?execute=false
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
4.7.168.74 White Haven, United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

access-control-allow-origin
https://www.theepochtimes.com
date
Wed, 29 Nov 2023 15:43:09 GMT
server
nginx/1.20.1
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
allow
GET, POST, OPTIONS, PUT, DELETE
access-control-allow-methods
GET, POST, OPTIONS, PUT, DELETE
activeview
pagead2.googlesyndication.com/pcs/ Frame 19C1 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvPm2v2H2LYRXlCM1zIS6Ad55nS4Hqil__jQlilwfkJ_aK41sOONLXc3j-7jDAsVgvAo9JpWj5ytQc9vX3vIt6X7Zy3ETHHjUyE6F2tr40DX3we1c7ueVA-s0q8zqI7GYa5BnHV_V4eLA&sai=AMfl-YS21g8cGaf8CSPAnYfJhzV0WEp3Bfn_1mqNRnMuFSKHBnHaUh0&sig=Cg0ArKJSzJHTV4TbyariEAE&id=lidar2&mcvt=1000&p=484,1152,734,1452&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231116&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3838852029&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701272586050&rpt=2543&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:09 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
post-log
tags.wdsvc.net/ 		0
440 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tags.wdsvc.net/post-log?v=4.10&amp;t=1701272587880
Requested by
Host: tags.wdsvc.net
URL: https://tags.wdsvc.net/controller.js?id=100415
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.202.83.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-202-83-199.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.theepochtimes.com
Date
Wed, 29 Nov 2023 15:43:10 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Keep-Alive
timeout=5
Content-length
0
Content-Type
text/html
/
insight.adsrvr.org/track/evnt/ 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/track/evnt/?adv=4tgsadn&ct=0:h4y4ikc&fmt=3&td1=18c1bbf8e68-tags8-69dbce70dd05d
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:10 GMT
server
Kestrel
content-length
70
content-type
image/gif
/
insight.adsrvr.org/track/conv/ 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/track/conv/?adv=4tgsadn&ct=0:cbmj8de&fmt=3&orderid=&vf=&v=&td1=18c1bbf8e68-tags8-69dbce70dd05d
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:10 GMT
server
Kestrel
content-length
70
content-type
image/gif
/
insight.adsrvr.org/track/conv/ 		70 B
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/track/conv/?adv=4tgsadn&ct=0:idisnfs&fmt=3&orderid=&vf=&v=&td1=18c1bbf8e68-tags8-69dbce70dd05d
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:10 GMT
server
Kestrel
content-length
70
content-type
image/gif
collect
region1.analytics.google.com/g/ 		0
45 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-RD0QM5H02Q&gtm=45je3b81v884763001&_p=1701272584324&gcd=11l1l1l1l1&dma=0&cid=468256303.1701272584&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EEI&sid=1701272584&sct=1&seg=0&dl=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&dt=Spot%20the%20Difference%20Daily-%20Play%20Now%20online%20%26%20100%25%20Free%20%7C%20The%20Epoch%20Times&uid=&_s=2&tfd=7810
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RD0QM5H02Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theepochtimes.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 29 Nov 2023 15:43:10 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.theepochtimes.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
ingestion.contentinsights.com/ 		0
88 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ingestion.contentinsights.com/a?d=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&f=2748&pid=3956489&b=&u=1701272586274.29376783.274442263&ul=1701272586275.449650498.31516016&at=5&ar=5&ts=1701272591&seq=1&x=0.2617614528198904&err=1&ver=21
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.228.144.102 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-144-102.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection
keep-alive
Date
Wed, 29 Nov 2023 15:43:11 GMT
client
accounts.google.com/gsi/ 		199 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/client?_=1701272583932
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4fb731738e143f7dcecc1db22ae8b99c0804b76d173b9f76a618f89ee8d1d171
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-kLEYoe8wGKdZStGgqDvh4w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:12 GMT
content-security-policy
script-src 'report-sample' 'nonce-kLEYoe8wGKdZStGgqDvh4w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
application/javascript; charset=utf-8
cache-control
private, max-age=1800
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Wed, 29 Nov 2023 15:43:12 GMT
style
accounts.google.com/gsi/ 		533 B
328 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/style
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi-ip.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-u__Pa5gDa1yCnX-STdQuRw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:12 GMT
content-security-policy
script-src 'report-sample' 'nonce-u__Pa5gDa1yCnX-STdQuRw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
text/css; charset=utf-8
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Wed, 29 Nov 2023 15:43:12 GMT
status
accounts.google.com/gsi/ 		40 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/status?client_id=490013421558-fsr5v4sfmmhdjuqbnpoghql9do3gmjk9.apps.googleusercontent.com&as=DlSq%2FaX0EH4wNLVskxLAqQ
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client?_=1701272583932
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
9390e43511f13f86c4b2783d3ce1165539e8797e17a2af0f413fe72f91f53821
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-BCBO0_TDFkYqWI9C4oSUXg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 15:43:12 GMT
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-BCBO0_TDFkYqWI9C4oSUXg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
x-content-type-options
nosniff
content-encoding
gzip
content-disposition
attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
server
ESF
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.theepochtimes.com
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Mon, 01 Jan 1990 00:00:00 GMT
r
ingestion.smartocto.com/ 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ingestion.smartocto.com/r?p=0%3Alpjxrt9k%3Amiu3kHrkCClYQJYCtNy9yRx9Abq5vcrz&s=0%3Alpjxrt9k%3Ai0dl9Lg6KUTEhSDiEyBod6i78SotrbYQ&v=0%3AfR3giORqJ7tfZTnEOrAND93d3cP5tpMX&e=0%3AfR3giORqJ7tfZTnEOrAND93d3cP5tpMX1&c=1701272592408&n=f&f=f&l=https%3A%2F%2Fwww.theepochtimes.com%2Fepochfun%2Fspot-the-difference-daily-3956489&i=1600&j=1200&k=1&w=1600&h=1200&t=readingTime&ar=5&at=5&bid=epochtimesus&rid=3956489
Requested by
Host: tentacles.smartocto.com
URL: https://tentacles.smartocto.com/ten/ingestion.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.187.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-30-187-221.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://www.theepochtimes.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.theepochtimes.com
Date
Wed, 29 Nov 2023 15:43:12 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cm-supply-web.gammaplatform.com
URL
https://cm-supply-web.gammaplatform.com/adx/usersyncsupply?pid=1&t=pixel

Verdicts & Comments Add Verdict or Comment

216 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| documentPictureInPicture object| __next_s string| amuCustomerId number| amuSubId string| amuKey string| amuEmbedType string| amuTemplateType string| amuFeature object| GibberishAES object| UU number| totalChunks string| enc string| e_enc object| j function| iFrameResize object| __next_f object| webpackChunk_N_E object| next object| _N_E object| WebStreamsPolyfill function| __next_require__ function| __next_chunk_load__ object| regeneratorRuntime object| mParticle object| googletag object| pbjs object| ep function| $ string| eet_cat_ids string| eet_cat_names string| eet_term_ids string| eet_all_term_ids string| eet_tags string| eet_tags_slugs string| eet_author_name string| eet_page_type string| eet_post_id string| eet_publish_date number| eet_publish_timestamp string| eet_last_updated_date string| eet_primary_category string| eet_primary_category_name string| eet_primary_category_top_parent boolean| eet_no_ads number| eet_word_count string| eet_ads_term_ids undefined| featured_img_thumbnail boolean| eet_is_premium_article undefined| eet_post_countries object| grumi object| dataLayer function| gtag object| mPartUtil object| ggeac object| google_tag_data object| google_js_reporting_queue object| pbjsChunk object| _pbjsGlobals object| google_tag_manager function| loadMParticle function| initMPartSDK function| onYouTubeIframeAPIReady object| gaGlobal object| MicroModal string| GoogleAnalyticsObject function| ga function| expired object| epSubs undefined| google_measure_js_timing object| GooglebQhCsO function| referral function| setCookie function| getCookie object| gaplugins object| extractedURLParams object| braze number| google_unique_id string| slotElement object| mp object| popupPaywall object| renderPayLaterWall object| freeTrialExperience object| accountVerificationCheck object| dynamicBoost object| paidTrialExperience object| shareParams object| optimizerUI function| loadMixpanel string| debugEvent object| mixpanel number| readScroll number| debugMPpageImpression object| optimizerDataLayer function| BASE_URL object| arcanumUI object| script function| RegisterDesktopArticlePageObservers function| mpCommonTrackVisible function| registDesktopCommonObserver function| mpTrackTestSegments function| mpTrackElementsArticleMobile function| mpTrackElementsHomePageDesktop function| registerOnClickTrack function| trackHomePageNavSideBar function| mpTrackElementsArticleDesktop function| mpTrackElementsBottomArticleRecommendation function| mpTrackSidebarVisible function| testMparticle function| waitForSmartoctoScript function| trackOriginalSource function| loadPreparedProfile function| loadPreparedProfileData function| processSoftlogin function| destroySoftlogin function| paymentUpdatePopup function| copyTextToClipboard function| articleShareWidgetBottomMobile number| softLoginDeployment function| initShareWidget function| renderShareWidget function| etso_init_ain_object function| etso_initSmartoctoInsights function| etso_initSmartoctoTentacles function| etso_init_keys function| etso_init_smartocto function| etso_init_smartocto_conversion function| etso_track_conversion function| googleOneTapCallback string| epochShareWidgetVersion string| shareWidgetMode object| etso_keys object| geq function| empty object| GoogleGcLKhOms function| rbuPopUp string| etso_post_id string| etso_maincontent string| etso_title string| etso_pubdate string| etso_authors string| etso_sections string| etso_tags string| etso_access_level object| _ain object| visibly string| bb object| tentacles object| t boolean| tentaclesProcessedABTitles number| tentacle_timer_apply boolean| tentaclesExecuted function| GeAnalytics function| geLoadLi function| _0x3f5321 boolean| geqpreprun function| run_ge function| _0x112b function| _0x543d object| gekx object| liQ object| _geq object| ingestion object| _smoc function| trackReadingTime number| tentacles_at_timer_sample number| tentacles_at_timer_send_beat object| _visibly object| google_image_requests object| __li__evt_bus object| liQ_instances object| _qevents undefined| dynamicPixel object| uetq function| twq function| quantserve function| __qc object| ezt object| _qoptions function| UET function| UET_init function| UET_push object| ueto_2f51fe09f0 object| twttr object| WDSMemberConfig object| WDSConfig number| timeout function| clarity object| clarityuetq boolean| tpc_present object| mpTrackedElements object| default_gsi object| _F_toggles object| google object| __G_ID_CLIENT__ object| closure_lm_589310

174 Cookies

Domain/Path Name / Value
i.liadm.com/s Name: _li_ss
Value: ChMKBgjdARDOFgoJCP____8HENgW
.liadm.com/j Name: lidid
Value: 796122b8-c3e3-46b0-9ad7-7eb07c37140c
i6.liadm.com/s Name: _li_ss
Value: CgA
.theepochtimes.com/ Name: _ga
Value: GA1.1.468256303.1701272584
.theepochtimes.com/ Name: _gcl_au
Value: 1.1.1153095268.1701272584
.theepochtimes.com/ Name: pageviewCount_fb
Value: 1,none,https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
.minutemedia-prebid.com/ Name: wrvUserID
Value: Icc-qs9zkp_mm
www.theepochtimes.com/ Name: epoch_geo_country
Value: ch
.omnitagjs.com/ Name: ayl_visitor
Value: 27ffea6a5325c5e842e37fd7292829a8
.theepochtimes.com/ Name: mp_s
Value: %7B%22utm_source%22%3Anull%2C%22utm_medium%22%3Anull%2C%22utm_campaign%22%3Anull%2C%22utm_content%22%3Anull%2C%22utm_term%22%3Anull%2C%22entry_referrer%22%3A%22%22%2C%22entry_referrer_url%22%3A%22%22%2C%22entry_clean_url%22%3A%22%22%2C%22search_engine%22%3Anull%2C%22id%22%3A%22lpjxrry59x0fuq4hndv%22%2C%22total_pages%22%3A1%2C%22start%22%3A1701272585021%7D
.theepochtimes.com/ Name: e_ab_es
Value: 0.09121156908815142
.theepochtimes.com/ Name: ab.storage.sessionId.63facf2c-fb11-4a1e-bdfc-4439a2cb1142
Value: %7B%22g%22%3A%222406380e-ca68-b3b4-6cba-cb05fe1edcb1%22%2C%22e%22%3A1701274385258%2C%22c%22%3A1701272585258%2C%22l%22%3A1701272585258%7D
.theepochtimes.com/ Name: ab.storage.userId.63facf2c-fb11-4a1e-bdfc-4439a2cb1142
Value: %7B%22g%22%3A%22818560984649130755%22%2C%22c%22%3A1701272585258%2C%22l%22%3A1701272585259%7D
.theepochtimes.com/ Name: ab.storage.deviceId.63facf2c-fb11-4a1e-bdfc-4439a2cb1142
Value: %7B%22g%22%3A%22621ef3e1-286a-b768-a214-758118769464%22%2C%22c%22%3A1701272585260%2C%22l%22%3A1701272585260%7D
www.theepochtimes.com/ Name: firstVisit
Value: 1domain=theepochtimes.com
.theepochtimes.com/ Name: mp_lib
Value: %7B%22distinct_id%22%3A%20%22%24device%3A18c1bbf8485b5e-0d5f368e6b89b9-5771e33-1d4c00-18c1bbf8485b5e%22%2C%22%24device_id%22%3A%20%2218c1bbf8485b5e-0d5f368e6b89b9-5771e33-1d4c00-18c1bbf8485b5e%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
.theepochtimes.com/ Name: _ga_2601429205
Value: GS1.1.1701272585.1.0.1701272585.0.0.0
.theepochtimes.com/ Name: epoch_persistent_user_id
Value: anon9dbb-1a53-4d9f-a180-c22c4c2e219b
.doubleclick.net/ Name: IDE
Value: AHWqTUnjd16nDdL0fEHTOH0K6IWP2oGqeNAUpxNppk5xspA_f1A4KZEYZBfbRY05ghc
.theepochtimes.com/ Name: __gads
Value: ID=b7abe158499f430e:T=1701272584:RT=1701272584:S=ALNI_MZPxzflCVmWkE08pZyIFm9wfv9AFA
.theepochtimes.com/ Name: __gpi
Value: UID=00000cfd2391cf54:T=1701272584:RT=1701272584:S=ALNI_MYLcnmm2Um-xBlULlrdq5pTGAwZhQ
.theepochtimes.com/ Name: _ga_RD0QM5H02Q
Value: GS1.1.1701272584.1.0.1701272586.58.0.0
www.theepochtimes.com/ Name: _ain_cid
Value: 1701272586274.29376783.274442263
www.theepochtimes.com/ Name: _ain_uid
Value: 1701272586275.449650498.31516016
www.theepochtimes.com/ Name: _geuid
Value: 021f82a7-7f5e-4152-9436-2d1f2f09c23c
www.theepochtimes.com/ Name: _geps
Value: true
www.theepochtimes.com/ Name: _sotmsid
Value: 0:lpjxrt9k:i0dl9Lg6KUTEhSDiEyBod6i78SotrbYQ
www.theepochtimes.com/ Name: _sotmpid
Value: 0:lpjxrt9k:miu3kHrkCClYQJYCtNy9yRx9Abq5vcrz
.theepochtimes.com/ Name: _li_dcdm_c
Value: .theepochtimes.com
.theepochtimes.com/ Name: _lc2_fpi
Value: 57b4458eb59c--01hgdvz2xx52zhtpkasf60wjrm
.theepochtimes.com/ Name: _lc2_fpi_meta
Value: {%22w%22:1701272587198}
.advertising.com/ Name: A3
Value: d=AQABBAtcZ2UCEOBFcovGXuykZgf-tfNQKRUFEgEBAQGtaGVxZbti0CMA_eMAAA&S=AQAAAvlWv__mN9s02IYd4Wcd390
.sitescout.com/ Name: ssi
Value: f676e6df-9bbb-4cec-987d-79846da56eff#1701272587233
.casalemedia.com/ Name: CMPS
Value: 5300
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
pixel.rubiconproject.com/ Name: receive-cookie-deprecation
Value: 1
.openx.net/ Name: i
Value: 6a9969f3-ffed-4e3a-83f2-2cf698183a84|1701272587
.rubiconproject.com/ Name: khaos
Value: LPJXRTOQ-N-6ZRW
.pubmatic.com/ Name: SyncRTB3
Value: 1702425600%3A220
.pubmatic.com/ Name: KADUSERCOOKIE
Value: B99C0422-528B-4F59-A7AA-BD4404C94C44
.yahoo.com/ Name: A3
Value: d=AQABBAtcZ2UCELKDJuCsraQTZgjyh55XMgQFEgEBAQGtaGVxZbti0CMA_eMAAA&S=AQAAAkNDd21DUVJUZ9HjN4W4d4c
.sitescout.com/ Name: _ssuma
Value: eyIyNCI6MTcwMTI3MjU4NzMzNiwiMzkiOjE3MDEyNzI1ODcyNzUsIjciOjE3MDEyNzI1ODcyNzUsIjgwIjoxNzAxMjcyNTg3Mjc1fQ
.casalemedia.com/ Name: CMID
Value: ZWdcC-sXacToKX2bjE7h3AAA
.casalemedia.com/ Name: CMPRO
Value: 5300
.quantserve.com/ Name: mc
Value: 65675c0b-6104e-df994-b21b7
.adsby.bidtheatre.com/ Name: __kuid
Value: bf9086ab-e8ba-45bb-90be-499af4372459.470486587
.creativecdn.com/ Name: u
Value: bMKnUH9IHQPdqwudcblk
.creativecdn.com/ Name: g
Value: bMKnUH9IHQPdqwudcblk_1701272587410
.creativecdn.com/ Name: ts
Value: 1701272587
.csync.loopme.me/ Name: viewer_token
Value: 261f5beb-0718-478a-9ff7-4afd0eca556a
.w55c.net/ Name: wfivefivec
Value: oDjxqhXq1R8mIr5
.3lift.com/ Name: tluid
Value: 431352185976743711462
.company-target.com/ Name: tuuid
Value: 75608216-8d33-459b-8783-54e4d5df9632
.w55c.net/ Name: matchcasale
Value: 5
.contextweb.com/ Name: V
Value: 6Eba1g0IjY3t
.contextweb.com/ Name: pb_rtb_ev
Value: 3-1o9m|8nK.0.1
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 6746b1382751660a
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAA_-MSNjU0MDcxNrYwNjSyMLK0NDE3NBXiM9St8kzKDw4oCs3ITUoHAJiARKwlAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAA_-MSNjU0MDcxNrYwNjSyMLK0NDE3NBXiM9St8kzKDw4oCs3ITUoHAJiARKwlAAAA
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZWdcCwADQpy1QABU
.smartadserver.com/ Name: pid
Value: 8325801272123076523
.crwdcntrl.net/ Name: _cc_dc
Value: 1
.crwdcntrl.net/ Name: _cc_id
Value: 87100608aead5db818596d798c03b857
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4XmNQsDA3NDAwM7BITE1MMU1JsjC0MLU0SzG3tEg2ME6yMDVnAILU9BhuEA0FADvZCZU%3D"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4XmNgYGBITY%2FhBlJQAAAPnAE0"
.theepochtimes.com/ Name: _uetsid
Value: fe033d408ecd11ee8e3cff6ba2d1f93b
.theepochtimes.com/ Name: _uetvid
Value: fe031e708ecd11ee8620dd95ba27fc47
.pubmatic.com/ Name: pi
Value: 160318:3
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 2
.scorecardresearch.com/ Name: UID
Value: 11Fb5b9b7e2d08e438503a11701272587
.bing.com/ Name: MUID
Value: 0C206B455AD768603F6F789D5B8C69FF
.undertone.com/ Name: UID_EXT_39
Value: f258318d-56c5-4dae-b3a1-fbd90b93292b
.undertone.com/ Name: UID_EXT_57
Value: ZWdcC14uS3-iD3DAYpf7EwAACHQAAAAB
.undertone.com/ Name: UID_EXT_56
Value: y-yyvHb7FE2uHD9V7Z7qO_e9LB_bkQhg5NSChsZN8-~A
.quantserve.com/ Name: d
Value: EJsBEgHFKsujDsvLEA
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAA_1vFyGtobmBoZG5kamFubmj5C5lvYm4OAMucfbkgAAAA
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-3a5d772a-6f6b-5b93-7f85-aa61daea4c72.l2Bk4%2Fy6Rxqs8les9eSVIEU%2BBefGz3F5deMzw9XzFvQ
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-3a5d772a-6f6b-5b93-7f85-aa61daea4c72.l2Bk4%2Fy6Rxqs8les9eSVIEU%2BBefGz3F5deMzw9XzFvQ
sync.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AOl13Km9rW5N_haph2upMcrnDR9k.qm%2BzTs6Zf9hRYXIa9miMOvQOmq7iBAy64z87uDwCAZM
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AOl13Km9rW5N_haph2upMcrnDR9k.qm%2BzTs6Zf9hRYXIa9miMOvQOmq7iBAy64z87uDwCAZM
.blismedia.com/ Name: b
Value: 65675C0B42D2E3EF2D0CCF75BLIS
.company-target.com/ Name: tuuid_lu
Value: 1701272587|ix:0|rp:0
.criteo.com/ Name: uid
Value: b96e9db1-3894-42bb-b605-10b056c02dc6
.simpli.fi/ Name: suid
Value: D2CB47E4AB91487CBCDB48C9EEE02968
.adfarm1.adition.com/ Name: UserID1
Value: 7306910122771347601
.acuityplatform.com/ Name: auid
Value: 858191110320
.acuityplatform.com/ Name: aum
Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRgZ3eHCmmGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYGd3hwpo90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="
.tapad.com/ Name: TapAd_TS
Value: 1701272587747
.tapad.com/ Name: TapAd_DID
Value: a60fcf94-eaef-46ab-a259-857f85253c14
.amazon-adsystem.com/ Name: ad-id
Value: A_TlbTz7BU7HvrSUXWRYONE
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.wdsvc.net/ Name: _wdTest
Value: accept
.wdsvc.net/ Name: wds_random
Value: 2023-11-29T15:43:07.768Z~2023-11-29T15:43:07.768Z|1862284516118621|95|
.analytics.yahoo.com/ Name: IDSYNC
Value: "1969~2fbr:18z9~2fbr:18vk~2fbr:19e0~2fbr"
.smartadserver.com/ Name: TestIfCookieP
Value: ok
.smartadserver.com/ Name: pbw
Value: %24b%3d16890%3b%24o%3d11100
.smartadserver.com/ Name: csync
Value: 104:LPJXRTOQ-N-6ZRW
s2s.t13.io/ Name: uids
Value: eyJ1aWRzIjp7fSwidGVtcFVJRHMiOnsicnViaWNvbiI6eyJ1aWQiOiJMUEpYUlRPUS1OLTZaUlciLCJleHBpcmVzIjoiMjAyMy0xMi0xM1QxNTo0MzowNy44NTU0MzcxNDNaIn19fQ==
sync.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKILYits3gPf57N9DAuLFzZ1xS3mHxEvu9wArcsiv5SHzvEHwYBCCLuJ2rBjABOgTwi70wQgSe-k10.%2BWtd9LE35yjoICoq1jW5hDOsYid9O8sBeLQ5LH%2FbfkE
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKILYits3gPf57N9DAuLFzZ1xS3mHxEvu9wArcsiv5SHzvEHwYBCCLuJ2rBjABOgTwi70wQgSe-k10.%2BWtd9LE35yjoICoq1jW5hDOsYid9O8sBeLQ5LH%2FbfkE
.undertone.com/ Name: UID_EXT_53
Value: B99C0422-528B-4F59-A7AA-BD4404C94C44
.undertone.com/ Name: UID_EXT_54
Value: f676e6df-9bbb-4cec-987d-79846da56eff-65675c0b-4348
.brand-display.com/ Name: _knxq_
Value: 8cc7d1e1-12b3-b56f-4c073297.1701272587.0.1701272587.1701272587
.adnxs.com/ Name: anj
Value: dTM7k!M40DF7/.XF']wIg2C''dqih?!]tbP6j2F-.aDyjByG0>mcC5n.y4Et>yNPu24R(UXV7e:jWKo/:4=sB!$<eR/91bH
.adnxs.com/ Name: uids
Value: eyJ0ZW1wVUlEcyI6eyJydWJpY29uIjp7InVpZCI6IkxQSlhSVE9RLU4tNlpSVyIsImV4cGlyZXMiOiIyMDI0LTAyLTI3VDE1OjQzOjA3WiJ9fSwiYmlydGhkYXkiOiIyMDIzLTExLTI5VDE1OjQzOjA3WiJ9
a.clickcertain.com/ Name: _ccpx_u
Value: 857d3406%2d12b1%2d41b8%2d8008%2dc69612572104
.undertone.com/ Name: UID_EXT_47
Value: LPJXRTOQ-N-6ZRW
.adform.net/ Name: C
Value: 1
.bidr.io/ Name: bito
Value: AAD_007KzrgAABRHedWbqg
.bidr.io/ Name: bitoIsSecure
Value: ok
.linkedin.com/ Name: bcookie
Value: "v=2&8ff20d87-b070-4899-8c30-204e1a9c8a26"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MDEyNzI1ODc7MjswMjF5yBYQDWlY3HwnP0hGKxVKwb6NAjY64/usyZgK4rbqfQ==
.linkedin.com/ Name: lidc
Value: "b=TGST01:s=T:r=T:a=T:p=T:g=3190:u=1:x=1:i=1701272587:t=1701358987:v=2:sig=AQHGg3Max-j2r2sYLEJo5d4ErXJx7hEh"
.dotomi.com/ Name: DotomiTest
Value: 58b5e8911052170a
.yieldmo.com/ Name: yieldmo_id
Value: 3FUAILL__uLNUqDMjlnL%7C1701216000000%7C0
.ads.yieldmo.com/ Name: ptrrc
Value: LPJXRTOQ-N-6ZRW
.adform.net/ Name: uid
Value: 3199104349002520066
.theepochtimes.com/ Name: __qca
Value: P0-153325437-1701272587518
.bidswitch.net/ Name: tuuid
Value: 703c8abe-24c7-4b70-aa60-bbf93e93964e
.bidswitch.net/ Name: c
Value: 1701272588
.bidswitch.net/ Name: tuuid_lu
Value: 1701272588
.dotomi.com/ Name: DotomiUser
Value: 706607330481298732$3$660540234$$1
.mxptint.net/ Name: mxpim
Value: R35CAB_10CE9DDD0_40041FD0.1.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065675C0B
prebid-s2s.media.net/ Name: uids
Value: eyJ1aWRzIjp7fSwidGVtcFVJRHMiOnsicnViaWNvbiI6eyJ1aWQiOiJMUEpYUlRPUS1OLTZaUlciLCJleHBpcmVzIjoiMjAyMy0xMi0xM1QxNTo0MzowOC4wMzE1MTY4ODVaIn19LCJiZGF5IjoiMjAyMy0xMS0yOVQxNTo0MzowOC4wMzA5ODAxMzVaIiwiaG9zdF91aWRzIjp7fX0=
.theepochtimes.com/ Name: alo_uid
Value: a634b748-2bfc-4ac8-9408-aee689913aec
a.clickcertain.com/ Name: _ccpx_244b81b94c69796
Value: 1
a.clickcertain.com/ Name: _ccpx
Value: 244b81b94c69796
prebid.a-mo.net/ Name: _Amc_b
Value: 0
.connatix.com/ Name: cnx_userId
Value: 4c7981aee0054ecd914b7fcdabe7ee6c
www.clarity.ms/ Name: CLID
Value: 33ada7e9e3734bfc9d6db4a43a341e42.20231129.20241128
.aniview.com/ Name: 1_C_5
Value: LPJXRTOQ-N-6ZRW
sync.aniview.com/ Name: 1_C_5
Value: LPJXRTOQ-N-6ZRW
.twitter.com/ Name: guest_id_marketing
Value: v1%3A170127258803262921
.twitter.com/ Name: guest_id_ads
Value: v1%3A170127258803262921
.twitter.com/ Name: personalization_id
Value: "v1_FFi22dj/zG4WxBgCEvoChw=="
.twitter.com/ Name: guest_id
Value: v1%3A170127258803262921
.t.co/ Name: muc_ads
Value: 7d30dd25-d46f-4fc3-896d-e72e73935bfe
.turn.com/ Name: uid
Value: 8166104921769197507
.smadex.com/ Name: smxtrack
Value: 2cb3d839-a303-43e0-8534-af27e78e4830
.smadex.com/ Name: smxrbc
Value: 1
.ex.co/ Name: exco-uids
Value: {"rubicon":{"UID":"LPJXRTOQ-N-6ZRW","Expire":"2023-12-06T15:43:08.093625887Z"}}
beacon.lynx.cognitivlabs.com/ Name: UID
Value: 7bc850e3-be78-4ae0-a1cc-36d2632af28c
.theepochtimes.com/ Name: _clck
Value: rez1gt%7C2%7Cfh4%7C0%7C1428
.serverbid.com/ Name: CONSUMABLEID
Value: 4150cf0c40e44ed290cf0c40e43ed2af
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-c7b9ee18-5405-4b53-9cd4-cf4ab127c5c1-003%22%2C%22nxtrdr%22%3Afalse%7D
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-c7b9ee18-5405-4b53-9cd4-cf4ab127c5c1-003%22%7D
.eqads.com/ Name: EQUser
Value: UID=f9aac181-5916-4a6c-8bfe-4da28fe814aa
.tribalfusion.com/ Name: ANON_ID
Value: aunsuBwl6h7bQQwbPBqU87DmELOA3vc7g8wurpQOnPvFMP0JOwkZbCVnLwB6ad8BsADu3vK4HUTJLvr3d
beacon.lynx.cognitivlabs.com/ Name: ss
Value: D4GWJCLYAtyZ5sPFKMBu51nJo741I7q1fv19CoF7GDPW2UN921D2uSiZqGGTIA247AzlDKsV%2B2HPKM7PHr%2BQvA%3D%3D
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 0C206B455AD768603F6F789D5B8C69FF
pool.admedo.com/ Name: tuuid
Value: 66271bd1-5204-4bab-902d-e29bf870fd9b
pool.admedo.com/ Name: c
Value: 1701272588
pool.admedo.com/ Name: tuuid_lu
Value: 1701272588
.w55c.net/ Name: matchgoogle
Value: 3
.ipredictive.com/ Name: cu
Value: 2e121d07-9736-44ed-b08e-9137df2b6ccd|1701272588344
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 0C206B455AD768603F6F789D5B8C69FF
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0
.socdm.com/ Name: SOSYNC
Value: anNvbjp7InJ1Ymljb24iOjE3MDEyNzI1ODh9
.primis.tech/ Name: csuuid
Value: 65675c0c62850
.rubiconproject.com/ Name: audit
Value: 1|VQKEXQ4FeoBhOxX/6Siqslwrb48aJjKPxAOjV1rM1Qb9MbvQsxHvgFYFyZyTESTFGwmQJoOoE5VCqQ3+tQhlLHMDvubSxZCG2MOweBw0EYqx+lJQzvbc5TLPgIxnOLeOpmvllXEtYN4=
.liadm.com/ Name: lidid
Value: 722f175b-6736-40ec-93b4-fd134ef576e0
.bluekai.com/ Name: bku
Value: k9L999hzjtD9HBz7
.bluekai.com/ Name: bkpa
Value: KJy9cxeid02pSUHknp/8BMxdSVx2q6H3KcaGVcWhDMC+uU/N9yY1DQZO
.w55c.net/ Name: matchbluekai
Value: 3
.theepochtimes.com/ Name: _clsk
Value: 12ps0rg%7C1701272588621%7C1%7C0%7Co.clarity.ms%2Fcollect
.kargo.com/ Name: ktcid
Value: 501dc039-3586-0c72-5908-5c7ecb1139ea
.alocdn.com/ Name: uuid
Value: fc0d8eb8-7534-42bd-be4e-81d15033fa6c
p.alocdn.com/ Name: _ep
Value: 1701272588
.theepochtimes.com/ Name: wds_random
Value: 2023-11-29T15:43:07.768Z~2023-11-29T15:43:07.768Z|1862284516118621|95|
.theepochtimes.com/ Name: __WDS1
Value: %7B%22da_100415%22%3A%7B%22hu%22%3A%222023-11-29T15%3A43%3A10.069Z%22%7D%7D

14 Console Messages

Source Level URL
Text
javascript warning URL: https://www.googletagservices.com/tag/js/gpt.js(Line 9)
Message:
Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
network error URL: https://comment.youmaker.com/api/v1/user?site=remark
Message:
Failed to load resource: the server responded with a status of 401 ()
network error URL: https://img.theepochtimes.com/fonts/Acta-Book.otf
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://clientcdn.pushengage.com/core/b413bf4fa936cc351ac6476e0df69b50.js
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://img.theepochtimes.com/fonts/Acta-Medium.otf
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://img.theepochtimes.com/fonts/Acta-BookItalic.otf
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
other warning URL: https://securegames.iwin.com/m/uclick/spotthedifference/v_8/js/createjs.min.js(Line 16)
Message:
The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
security error (Line 6)
Message:
This document requires 'TrustedScript' assignment.
security error (Line 6)
Message:
This document requires 'TrustedScript' assignment.
security error (Line 6)
Message:
This document requires 'TrustedScript' assignment.
security error (Line 6)
Message:
This document requires 'TrustedScript' assignment.
network error URL: https://id.rlcdn.com/709414.gif
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=54
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://www.theepochtimes.com/epochfun/spot-the-difference-daily-3956489
Message:
The resource https://rumcdn.geoedge.be/19d3d93c-6e7a-4ab1-95d3-37f2020fd783/grumi.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

352c44ae8e3132a9bf53d7913c134ad8.safeframe.googlesyndication.com
a.clickcertain.com
a.remarketstats.com
a.tribalfusion.com
aax-eu.amazon-adsystem.com
accounts.google.com
ad.turn.com
ad4m.at
ads.yieldmo.com
ajax.googleapis.com
analytics.twitter.com
ap.lijit.com
api.smartocto.com
b-code.liadm.com
b1sync.zemanta.com
bat.bing.com
beacon.lynx.cognitivlabs.com
bh.contextweb.com
bttrack.com
c.bing.com
c.clarity.ms
c1.adform.net
capi.connatix.com
cdn.epoch.cloud
cdn.undertone.com
cdnjs.cloudflare.com
ce.lijit.com
clientcdn.pushengage.com
cm-supply-web.gammaplatform.com
cm.adgrx.com
cm.g.doubleclick.net
cm.smadex.com
cms.quantserve.com
code.jquery.com
comment.youmaker.com
connect.facebook.net
crb.kargo.com
creativecdn.com
cs.minutemedia-prebid.com
cs.yellowblue.io
csp.withgoogle.com
csync.loopme.me
cti.w55c.net
d.adroll.com
d7d3cf2e81d293050033-3dfc0615b0fd7b49143049256703bfce.ssl.cf1.rackcdn.com
dis.criteo.com
dmp.brand-display.com
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
e.serverbid.com
ea.epochbase.com
eb2.3lift.com
entertainment.service.amuniversal.com
eus.rubiconproject.com
events.iwin.com
exchange.mediavine.com
exchange.postrelease.com
fonts.googleapis.com
googleads.g.doubleclick.net
gw.geoedge.be
hb-api.omnitagjs.com
hb.minutemedia-prebid.com
hb.undertone.com
hb.yahoo.net
i.liadm.com
i6.liadm.com
ib.adnxs.com
id.rlcdn.com
id5-sync.com
idx.liadm.com
image2.pubmatic.com
image4.pubmatic.com
image8.pubmatic.com
img.theepochtimes.com
ingestion.contentinsights.com
ingestion.smartocto.com
insight.adsrvr.org
js.alocdn.com
live.primis.tech
m.iwin.com
match.adsby.bidtheatre.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
match.sync.ad.cpe.dotomi.com
maxcdn.bootstrapcdn.com
mixproxy.epoch.cloud
mp.theepochtimes.com
o.clarity.ms
onetag-sys.com
p.alocdn.com
p.rfihub.com
pagead2.googlesyndication.com
picayune.uclick.com
pixel-sync.sitescout.com
pixel.advertising.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
pm.w55c.net
polyfill.io
pool.admedo.com
pr-bh.ybp.yahoo.com
prebid-s2s.media.net
prebid.a-mo.net
pwe.epochbase.com
px.ads.linkedin.com
r.casalemedia.com
rbp.mxptint.net
region1.analytics.google.com
region1.google-analytics.com
rp.liadm.com
rp4.liadm.com
rtb-csync.smartadserver.com
rtb.adentifi.com
rubicon-match.dotomi.com
rubiconcm.digitaleast.mobi
rules.quantcount.com
rumcdn.geoedge.be
s.amazon-adsystem.com
s.company-target.com
s.seedtag.com
s.tribalfusion.com
s2s.t13.io
s3-us-west-2.amazonaws.com
s7.addthis.com
sb.scorecardresearch.com
sdk.iad-05.braze.com
sdk.minutemedia-prebid.com
secure-assets.rubiconproject.com
secure.adnxs.com
secure.quantserve.com
securegames.iwin.com
securepubads.g.doubleclick.net
services.epoch.cloud
sid.storygize.net
ssbsync.smartadserver.com
ssc-cms.33across.com
ssum-sec.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
subs.theepochtimes.com
subsapi.epoch.cloud
sync-tm.everesttech.net
sync.1rx.io
sync.adotmob.com
sync.aniview.com
sync.crwdcntrl.net
sync.ex.co
sync.intentiq.com
sync.ipredictive.com
sync.outbrain.com
sync.smartadserver.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
t.co
tags.bluekai.com
tags.w55c.net
tags.wdsvc.net
tentacles.smartocto.com
tg.socdm.com
token.rubiconproject.com
tpc.googlesyndication.com
tr.blismedia.com
um.simpli.fi
um4.eqads.com
ums.acuityplatform.com
unpkg.com
ups.analytics.yahoo.com
us-u.openx.net
use.fontawesome.com
usr.undertone.com
usync.vrtcal.com
visitor.omnitagjs.com
www.clarity.ms
www.facebook.com
www.google-analytics.com
www.google.ch
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.theepochtimes.com
x.bidswitch.net
cm-supply-web.gammaplatform.com
104.18.36.155
104.244.42.195
104.244.42.69
107.22.251.49
108.138.26.75
108.138.36.128
108.138.36.33
13.248.245.213
13.32.121.82
134.122.57.34
141.95.33.120
142.250.185.226
142.250.186.98
143.244.208.184
145.40.97.66
146.75.116.157
151.101.66.133
151.101.66.49
154.59.122.79
159.89.246.130
172.64.146.152
178.250.1.9
18.173.154.40
18.173.154.79
18.173.154.95
18.173.187.86
18.184.49.101
18.195.70.244
18.200.44.133
18.66.192.26
185.184.8.90
185.64.191.210
185.86.139.104
192.132.33.68
193.0.160.130
198.47.127.18
198.47.127.20
2.19.198.122
2001:4860:4802:32::36
2001:4860:4802:38::178
208.93.169.131
211.120.53.201
216.52.2.6
23.35.229.251
23.45.238.237
23.45.238.53
23.48.23.23
23.56.202.187
2400:52e0:1e00::1080:1
2600:1f18:730:b140:4f29:101d:62a7:ca97
2600:1f18:ed:550a:3539:381b:7999:2df1
2606:4700:20::681a:27a
2606:4700:20::681a:832
2606:4700:20::681a:ad1
2606:4700::6810:7caf
2606:4700::6811:180e
2606:4700::6811:9d16
2606:4700::6812:18ad
2606:4700::6812:acf
2606:4700:e2::ac40:8d0d
2606:4700:e6::ac40:cb07
2620:116:800d:21:e365:4988:e8a7:3270
2620:1ec:21::14
2620:1ec:bdf::44
2620:1ec:c11::200
2a00:1450:4001:802::2001
2a00:1450:4001:808::200d
2a00:1450:4001:80b::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2008
2a00:1450:4001:812::2003
2a00:1450:4001:829::2004
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::200a
2a00:1450:4001:830::2001
2a00:1450:4001:830::200a
2a00:1450:4001:831::2011
2a00:1450:400c:c1f::9c
2a02:fa8:8806:20::2010
2a02:fa8:8806:21::1780
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
2a04:4e42:400::649
2a04:4e42:800::282
2a04:4e42::645
2a05:d018:cc3:fe04:3684:ac58:ec44:5836
2a05:d018:d29:3605:110e:d660:4b1d:6eeb
3.124.253.58
3.217.218.110
3.71.149.231
3.72.120.49
3.81.188.147
34.102.198.207
34.107.140.113
34.107.148.139
34.110.129.224
34.111.113.62
34.120.33.89
34.149.50.64
34.160.19.107
34.199.87.86
34.228.147.1
34.249.188.76
34.95.81.168
34.96.105.8
34.96.71.22
35.157.195.10
35.163.158.243
35.168.179.116
35.204.158.49
35.210.53.219
35.214.210.123
35.244.159.8
35.244.174.68
35.71.131.137
37.157.6.254
37.252.171.53
37.252.172.123
38.68.201.140
38.91.45.7
4.7.168.74
44.219.140.141
45.137.176.88
46.228.164.11
46.228.174.117
50.31.142.223
51.89.9.252
52.152.143.207
52.202.83.199
52.209.84.7
52.210.176.42
52.210.49.96
52.22.32.84
52.3.98.252
52.30.181.208
52.30.187.221
52.46.155.104
52.57.12.239
52.92.178.24
54.170.64.73
54.198.207.123
54.216.109.54
54.219.114.202
54.228.144.102
54.82.17.205
54.85.57.117
63.251.14.14
64.202.112.95
66.6.101.151
66.6.101.188
67.202.105.24
67.220.226.233
68.219.88.97
69.173.144.139
69.173.144.165
69.192.160.219
72.251.241.196
81.17.55.172
85.114.159.118
96.46.186.182
98.98.134.243
99.84.88.104
99.84.88.111
99.84.88.13
99.84.88.43
99.84.93.134
0175ef65c5d8cd4ce63c030a8c409a33f73de027b1593bf77f780f91c3b07bdd
02e05d8407482aee2dae0ae4343ecb2e6c2b1f27c2175c4b03170d3f2af51b55
03268fb285ed8486b6a21e5106f8faa3d517434bbf60c0e9a09e7e2737ce1345
043f156b36cbe9177181059747715ccc59cfeee710c5a6bbe53aa37929991710
047fb9e91e2679dcce438ec8dfe0dad52442ebf73aa92bb1fb797f0c4e0d42d1
04f2329e7bc5aff19476780214be18ee34214d7a1f8bd4380761e712fadd994c
04f8090b918995b61062ffc6ad531cc6cbfcf87e3fdddf999be58f3eab8f677f
0523c13750f634735ff97f98cc6b2d0100bc0aab4d8f703ad3b6952731d7a545
064d7b833644dd282e4ab3ea2f965d8ec8d4cd6db6ab74c19d0e93df5bb6e823
091fa867686554a13fe1d783d79e005350166698d9908dab893e958b88995426
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b47413ab6869aa6112ffad500e425466563e48bc568c16a20005d8d719c8816
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c94797789d1ff77c0220cee8229aa616a330c2bc221d533a24a53bfc421fc3f
0ceee487a90eea3b0e52f01360b44e8b6ac0898062c143dbe724663efd3d6f63
0e3530366f481c19813abb79fd15cdc5b45dbbc276401cbde7c4bf283b75a114
0e4bc8f1a2c59e9e8e12e9f32a6812c46570925e9f72770d1475d8a1ee85476b
0e5fbbe10f708bf6bbcc9d5d91e7209391cf9798e3ac144d3dd3db2c2e698309
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
10fd19987fe77295a94dc1705bba56980c2c4ba3859e76b3f7248a476ad4b6a5
114f982584c95ba0b5a06f8b47f9117481552b142ef0b82de888f80265975380
1152f79a12543479de3ec4e56eaa913401cd934968ddfcbf833218f585a0e494
1203ee412fb623c6e6daeddbdebd5d2541223b9e9aff17991978939cd4ef6193
130cf3b5ec74e427ebbda3f25bf2e3fd316aa1e25fc47736aab0a76b458dea76
13b81e5fbcfd1eceeed6736de88e9fce3edf25dead86bb944c0cfe179695128b
16ca3aa97c894d331e7f3dadaee8f7ac8a66a30fc1f85c877bdca4cd911ef520
18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
1d9e0d05669a3610c7263c551b8b406344c148713485f7e8124f61b05e2463cd
1e23d5ae57d4c28be6a24923ee2e15d27739e59c99bf88b65ec0aea1eca7697e
1fa523e81d755c257b9653e3554d7ae6acf52ef5f24d5c95aa1b772aad455f68
1fbf42cca7f7ae74c38072d0079ef895e071dae27c920814f8c58446b8d3a8e1
2012cd4f45b6daba14c597f96666b2bdb074046bb7816bed9669a18c99c4ec0d
2217ed3c72b72b9496411a601e38bb2dc1520f0cbd840576541e1ef89a3eb730
229bbf4d0e7488209564152c6723497f1ac3934136ca1684233d2fa88fa4146f
240d99c3fe3eedbcd13cf69556ca791a8b8fd963a2d183c8a74ca4cea58272a9
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
26334b6e9122b102cc66898bceee5be00927575ff5bce29907a7b35a94688f37
26596e242c76558f8085c3d3a634ff993bc7ff98cdfb6d322bb7698c420e6bfe
26e70825f3b5817e1c9d35f52aca6469927c6fcf549f18568becc7ddcb3a9dce
26ff624027ec9de1d042248a164e0ed39b8585fe5611958a48c5e58a2b87fb92
273995351e70c08e82fa829bc8c06a871d3809f00c3b7dbc0633278ba194a9f6
27d67175ee9fdf263362ffaf194a4244d29c77f3dd277473d018cd2e2f704cbb
282c2e3d26968b51b2150825454e32ad5d03e7fd849567c951fdfeb4fa44a170
2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a
2c9d20a82bcd631dba5fb5a9c1dbc507baf559da09375e65b8870a328fc6e470
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f009a44aa057e608440849ba7d59135c178393165207fb8268d1680f9365b5b
30cba8c6f7374a344b5a6d97dda6da6f92281144a7123bd7168349de7d85f4b3
30ee8dc4920b2dca6621737d57c70ab1dff3b54c52001d9488d2cf048c99c3c3
3188746e7bc3a92549608bd58ca7324a1acf1a957737f5c6bdd35b645ce823f9
32dc9f5798555b2f8c07bf8aedf23efb28d934350b3e377a57b47394df7afe06
350da8937f5f118f9000e1ddf5b8913c9b50837dbdc4cc906487737aefc00a1e
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
37d1365b74f5ad68cedb786f57c8a2e108354f7494ebbd46dc3cbe2a0af5befe
3ae32e5c134775466e093528de65d3d225644aaf7f81c1453b5174c95c3318b8
3bc7de8e39808225af0f8680e5df920d386b053b329123b5bd7e8ff6a820aaa3
3d7c7f77cc3bb5bf35042f2484343fdccd96a98ee0319542d32a4db82512e8ac
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3ebcd7d59c2e596630fee4b6f1500f960e63f514a6816f11031c2d484d1f2683
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
40952936a556d52b3b78b310a5ba4d1ab4ff92e4d4ebc28b239f81263c118464
41a491b6ec4c4ba2be42e5bf9040f0dc254b0fb6db203ad01cdfa10145fdcd21
42e4b57b58c431a4306450e77e5618f29dacc6e7eb8101b703e9e34e7d8bcdfd
45c45e2bb16ed0d3ff8fecc46f36a5f3645040b3b5b7f8cca6abf2699dba78fd
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
48b782933f4ffe1e923111eb93d3924b4807e78ce63064d0b01e0f96de529a4a
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c834812ad0c6ab8e9cddcf914f1f922d2b52cf81f306bdc361a05641bb0798c
4d5ffa9b4660a2cb3cc7733dd785224252768155d96805b19b862ef55af6d045
4dde8fd8ff5489e2aeb8fa399da386611608d749e5577f7acf4ff46aa6e2438b
4f500275ef2463ebe4b152fb0fc473ac0c71005b30af849cac060882c63b485e
4fb731738e143f7dcecc1db22ae8b99c0804b76d173b9f76a618f89ee8d1d171
5141d00d7542330143ed512b1bf5549cdd368bf99010fef0f56765818c716ab3
52c854815f543b120f9314bf012a95ff9902edef46b232928855005edd9cf67c
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5558beabf2d2b02f4f29c9a5588e064bd7014334dcfb104f34a7535b38348856
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
5811e5f3ab7f3f38906a81cfe0de05e194541de092bc539f2c7287a20c6e1c28
58255daa744ee7478e21dd58b685345e4f76d95522a5ba987c4e73e9281336c5
5c7987d2f26ca9bf8254df658877b74005f2e90d3f477eacc606e011341d8082
5ca92c06dc31883efdd21b50d74cfd8756fa7a312728339494e2298cb40b6a9f
5d103df41045bc8e9538ed05d79fdd7750af623fa8dd55fdc3b74d90d6ba20a0
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
5f20338b9aab2f5f33562eb3b0b23d999896ce426cacd2231b4123510571df4e
5fbb804264bebba8187a2b9a504f4cc216e7a0aca9947e40f0b9554e734edd8d
600a7f178e74cf227051f057b1b54c0277341f6a71914c09b766126ef0d5f90c
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62a15750a484370fd71813d636ea36a05425e1104a0e289aebb2dbbfb2849b65
6486dc0dd88f16d057de0089d5d280dd337fe701d214fe983e8a5296b547ef23
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
66de8327e8ba8313b51ce1152038d53d24bb3b0c6e4e6ef8a055d06f92b9ab2d
68d58fedffba037ce6ccb99e29a9944b1a60f44630b95f0bcc41ea41eb2e7322
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
6a871c9bac54dd086c8423a9948bf0ee32a23002e010f97f8b0ba473bdd7b452
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b54ccbabc5f2cc35faa1530cdce7e38e6344d207975ae21182db4a476a4e369
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6babdf3822ebdb78bab5319520dbf63865612e8fad397d858543cdad32dc5ff5
6c35947cc7611eef3295c9a61dc7cf129469eeae6eb8d34fb4b0dcecba82b556
6d819e03aaf3877c15b1d7d532cf06316663cad1aca835ac99497ab08e0bf0e9
7210db5c299a856c7f10c854485deaf0e274d963cefa8694a26f513fdad6f436
7408a7e4e9cbe0a4e20392af93833af4ddcf9a21934cd9424ccccd0c10e41d6b
7456ca7a60534034ee65b33ca59fb5fe7e0cc74a5a981967508be6496a58b642
7561ec2dc82f7edac7a440ad46f72c7b09bc8f6c75a14f1ba391de945da9cb2f
7646b2bb1cdb33243d053bc1dd166226cb25b119948f39f81f38244803f85288
76fc8b36e6351a6d7b756f4f25805f1389c5b5862f5d1fa7d21b1acf2de15423
7760469d02e7957e9a0d0d75a1822cc92d28e7960c8687dfa93401051f83e316
77daa4388c965a3e23b5a6c800727d8025ab108f89cf5679e79136986d5b4561
78906df37ee46e962f38eb80c613c2cc179c19dc91aed4004c342eec593b5933
7924847f88e388d4bf7f6c53a98cccfd3acf3cb68632440b3d154caf264170c7
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
7b89cffa52f19d5b7fe006af822e200718ca99c3ae6d5bfe3101991ca803e588
7bb5d448d600765bd6780d8857ed56c4c17df18c54b537976e7435a8ae70131e
7bf4473ecc25fc8a56c7da4846022537d11e73a499922e0a16be9b8f83869052
7c6f17e7a639b998b35fa6e575eb805e6efda2789431bd4c30ab2c46bd2345ec
7cb0ca1dd12fa46486a944429eae07a90c13403ccd57566f8ab948eadf0ffc55
801be445b05c75fe0501cb5ebe6c9d308855fa4465923f8372389bbda6854c24
81a0f3f83585c0223a44bc099e0d6ae756c970a831e9f56b1154e1dc8638f2ed
83b1c226ddee3a6b6f78e8a3d84d9cf590a157642b0da6db5917b4adb9f4f162
8425353bac621a584b0fe8bb963ffb29af8a8790aabb71f0173111a9599be5f5
8496667e6ca10b43d843e825b1f87efa7afc417328b26f815c1b3c5b533ec1a8
84c3113e3598c90572431f39b0563678912968c3e2616e42d757a09e7a2f1e28
85526a1f718fba197ba6c3bcbb062fbe6e0aa4dbff573484548218fa2eb43185
85648cea277f5e1dc4d97ae8a6e6417500a3b4a5c8ebea89acd7bb4bb89277ed
85b0a6b7e1a39cfab0b46283acb187039816c087dba5d16b7e64f78ee59a1137
86ec2da6a4b0444953187ebca1373c7eee98813073fd5ce9046739d006220e5d
884b2215f82d3eee559bbececf208a978c8167a2706da9b911492f4798b39537
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8c8838d55e3dee87762d5bf4fd2b1df3a7e773d58c2133022ae43d7ba8c6a930
8cb96c825619029e657cbc8ddb8c035814c868738cb667fc279b3cf3a218c920
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8d797b58dbbb90837bff92450e25c5a0fc90040116e51311437d9f2c4f03c94b
8ea8156a2defd83d0201fc63fee3f65908cdf7da8fbee7ad1ea5f6a2a982790e
9060be2fc8322a6ca1cb172cc5090ad393327ea6a993f01b1ad7a662db265ee2
9085790bc286fc03e43b1a9ad10128e7b8202fe0332d4c93ff67338f84089056
912cc294d0de9f7e737ecbd968834e11027f59047a3073c060c0112513d773f2
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9341bcd08be331a634026993544cf4d39803cd6b95e8e254250a890a08d2ea81
9390e43511f13f86c4b2783d3ce1165539e8797e17a2af0f413fe72f91f53821
93c87f976cf92a16c0de1912a209b8a1d5e85fe70057222b149f4b3852ebeaed
946c9c95fb7da4ae9249907e40e11291c00135e70991d34811f08617b20a5b67
9679406bfb3bdcbd74652282dd7257f1325ce1ed069d80e3cba9244ba1919dca
969ae449cbf09db3f280f57f8825ad388fcac6eba0d68a4d2ac5cfc46cc955ee
978d3ba4801394114df599b7401282e1e0ada60a155273078581c747c985dfaa
9814f85523d0253897e2447a36fdbdc2a5e7647eb96c192f3d278393c955d2f2
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a63d5248095b6078fd95a59c270efae7d1cc086d9911533010bfd6555482f96
9b105bfdc2a196ea90a25be8ab4c6764be3be930601ed42aa3e12092373c4765
9db33292007ab6c38527b39d5663e976a305564e19b2a5a8713ea2b2c00f505d
a01ff83777fd7b5566fbd0f49f273fb949fa62c946bf8b68c8569f88676a6c21
a03c03253413f46b99793ec18c78422e09a821d32b32d835e5946c149cb38c66
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e
a26f2837af50af431970d8d6c86ab1f2354b33258517cfed4e75c3b9eae272fa
a272a50a6b0526fe9222d72f29741b9d91a156ff75439a43b728fe1d5a6fec0f
a4551991444bea767a97af5120479bd3b786c29a14498dc3e13a8ea3a029dced
a55cd6de4655dc7bb21259ded6fb10e73640436324b5eb7f01c6a450baefa7df
a60d175e01e51a0456c5ae6b6f1db85ed996f99c3b20d6d1d66c721b66e4ac8b
a79e9fc14eb6b58fa3aa286664bea6e957bce0fcb705403a1a77aa65929250e1
a7a2326ddee860dc11970003afc7d867a1ac8d76a1a7cf26a7ce87c165703340
a7cf9d7d46a9d9b0d83d6d91e82f11dd37fbffab2d8841b530f352be0cb6cbd6
aa3eceebc8782791570f46b1442057bf2abefca9f78f1c8811bbe7cc43f3616d
ac44c50f0d84fdc26c60b8ce8bb8b4d30f10b31a0c877ee30ca1d0350483b6c4
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acb1221313fbb4d27f785ffd7a9ade0f7f44c37567ce1abf6aff7c399a7992d4
ad24663c62bcfab5cf179832fa7a087741361e97c292b601e4ca45d3ec14221d
ad5f6dda15141642e04d54d4ef048c6be955d9adcc5fb4a9704674c9ec71c356
afe63612de0976860ecee1a6a56bbaff6f9ac77530f878fe0c8749b9c3b50933
b033f59e4ffeaa6f3e4f2e839c035a14811d5469d3f772eda6056d7d5782c53f
b0512ff1ecca4eeaa79eabd6f059915e9cec84022c2f78519acf20d942b628e0
b0e70b299ab9c122ad93531fa8e5309833baecd53dd55c992c538f8b33bfa22d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b16aedf23eaa640fda30eb3cf864dc22c80c0a50d32b9ab5d537f291f66d74ca
b1a48777454353c2b6ff6e617c2caf64c290e2ba4f55fd74a30d97f734198c21
b20fe750004499fdf135b5e7bd2608b33dfa417dd63dfafed5ee8e80e029ae2b
b260521dc91bb9be40d0cb9e8ae37b39c94703b68d7d29cbcd5aad0922665a83
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
b49f0f3da5e676191fba5a73b30240e440586db2ca200d13b4501dd5184d700d
b5d46dad614c4aedcb92494a2944c7a343e59efff869fc9ba5ffbbacdb5df0f6
b7123bf5d1742985950f5f6ab3845907263a91e175527eb11baae5f45c3735a9
b75f430e209cb052e257a4461f31bc7723cf5115d5c1b4b49cfa147bf8fbb29b
b87db941ea15f78cb56978d7ebd689d68e4db1a4f50c40a7e217a8498c487593
bade9777ab933b6324666fedee893c4382b7ec482a10584ac9dd89a0fde3f768
bb38fd58abc07b914b84877f547b9cc6a91f08bdc759e2700f864d9d3cab7859
bfbcf9db364dcc67523b25da3243f768613963345d4d661a24afe82c20d38f0a
c0ae202bdbb35b4c08d044b9a3f5e799dd17ef00ac057c8a46764cd731246779
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf
c34e5d3266ea00298001d8d288f2772c0829a74b54b7687b683a3dcdd91a4d23
c37bfbca5f319e098f7b22df968808fc786e28afd4469f12f7b481cf95b67cd5
c62298477bd42f1c46d68b84e392835c73934351c1575fc42e913a5ea0500e42
c6cbe82680b8930f3096c6ae26c62238d76d7a299f61317cfcf3154b78d47dc3
c6efe5797cf0826affa1dad9e68852f73624d3360188765cc5eedd356f348f03
c704422aafb675b9272447d343329391f479d4aab004700782886ffee2a244f9
c79b952455a77dfa6e4dbf3474e887a4a6cccf285881103803651bf408b4b16a
c7d12e0bbcb4b4ffa36b2c6539d36c3f3fbd694c0025c75cbc4174fdf500cbfd
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
c99085b7fb1f2a887546ef03893582856b0ca792472ad92629a75177e66a803e
ca36edebedff418d8315a73c89adadf5c2857af4421a201304cbd2ba550159a1
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca85bd4aef40ae9050a93ad6b0c2f5632a7f29629c9ca59cdaf591f4f2789515
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
ccf7b12ecc8e9e8ffdde253ba24560e0b8742463ad4868c7659fc90968ffcb3a
ccfd8c01d2da74b0d0530b80106aeadb0b46adbe764c2f023e5760374090aa05
cda3dd8b74a8cb2699277dc3b4d82ac4482304fe884d47bc7638111bb5257bd8
ce174010dbecc7aec9280ffd46eabfa8189b99d461403f060178a4075a872446
cf145d0294d2ef90c4623482d53ee321535782fb7b9f59c10cbb4cfe34a7db95
cf2655168c9eaa1ed5fd7c01137b293e847ef49bec2f885703d9313608e0749c
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68
d038bbb5fa50aaa04d7e4f9a854820241ba594bdaf8275c5f004617b15c9ee30
d08110fb32a9fa5e161050a13a7980c6db1bdfedbd3a09ea2b263c8520faa7f6
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
d1a4a7aa00e62b62538f84f4f380c16796c88078656d204c4f5ceebb59d84fe8
d20db6c1df31874b999f525e1eb15c5041d7b5b94c7336754c97d72fca64c1f1
d30ebe5017ee0a99c84556e36d105000a7352a72b16bdd457a813ff75197ce46
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
d4fbdb5935b28450589b76b53bb1c5d0234d14de6b66173ffc6e38b91d1b1db3
d6261756586039c521b33cec507a4a6bf7646e4352fe2dd29ff44b145286df5e
d632c0bc914a2ed628780c4d21837a13ab8dce193e303b7cd6385f17437a7e49
d651ad7eae445421bd7bcc1b311239cfe95f65f9816703fc534c5f83435aa25f
d67edfce62f3f2a92258ccee1daf3e702d207f759f9dc65f11f18cf4f914b568
d728d838bf7568e84833439cc194e79dd411f4f952a96096bd2f2cc91c56729e
d73f53d60e8d626b9238c3334cff2d2ad92d6228ed6b0131c6e2cf488948ca60
d75e8f5e4b97a7b003c317c52b8f6587b9616e0f53a909b783c3f8663414619a
d7cd879df53ece5f82d10656b7890db0b9210823870eef37fceef4d7b133dd1c
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
d94f1a39acfe37b82ee50c1db98885a2fca89e81ca7850294df2dbde1f76972c
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddd2245c1fadd2a11a967993e9d1e4b91de6bd0e8622dfef98f20f228ca04f1d
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
ded9728e079116c2334f15330ad73001327dc2a1c8db43c946c5172c948e0a8e
dfabd954a3ec494e41f63bab6f12a56ce35150c3b6eb0da47f1e61d5c22bfc2a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40dbc6da95b47d932014e5a93f35b13a341a37ea6fe7559dca041dc77271cd6
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e59c8d560fff71627a3526971a9cf1d128c2024f6075d8863d2f15030d31597c
e5d558dc4fd6e6fcb8439f66cf4f2495568d312f91982ab3520cddc8c40479e9
e6671d84edbd24363471c068f8b96676940257cf02e911881fc18d6949a791c7
e6f3afe265986e684ce3c5a19901e43753328ced4ff16dc360d3768be03cff2c
e7f75abb89b10512d3b66dd62ad6df27f2793e338c12c3e415b60caba891f364
e80025d59b966e390e81818a115bcf1c8147512973c698731adfee1dbd942572
e9a6914e67d57334b8d67d9c707347897fef6034f24b9a3fa7051314666a41f3
e9a6c12c8ff448789eb1d44e1b3e9983321d5724de40bf191157188ba255a513
ead0293d41f0c5fef76a0205ad3060391bdbeec5ae4920c5c6d2edec8bdea2e6
ebeb5e1c053b28845daac052c0949fcbfb8ab11eb3aaf72ce792cdfde27ee51d
ecb740996ce05e9b7823c9690564a0d7b3840becad640d37e929cd4f4ee1cdf4
ee339f73c8812e9efdcf61161b86d2fd646ce96c3ff214b5e496232d4b37d99f
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f05e45157561299fdf9c77b4ead956006bd678b5e82ad3180d5284e333c3ca28
f065c87ccbdaf40a969620650e1e3f479ebb00369c87e714a454c6ea66b9a46d
f2acbdedb9ab48db13e574a4f5010c5a867cd4ba1f014bae3ad6dcc246e82580
f3bccf2ba4483214a64dd5d4222b45ae474f5d51bbc50bc80e7c78445e621772
f3d75d455699a9dfeaff6b790a794ba938bc7c5e2109cfb85b273804c2641f89
f4491b5b57d925f8936741639493af09c09be16d13906e9582d8589bcf3f80ac
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
f48a6d82840fe8d6952bd2570b2f0a960b42bba1b10d4786b0564f04be87fa19
f4e16c137bfcf443839c20e1038b9ee2dec570f047ae3b1c8f9378e9176750dd
f8cec560b6492c537272ade85fb140485f4d0e49c1bec8270d6c34244ddf8e25
fa1b185ed81ddd10ecddbdc522846d6b71b0023d4603929fd8b9e2538a7ede5a
fba79dbbefb3bc0ec989cc661e83bbe57f25e50c2df1b9640711520a240cf18e
fbd96f97dfabbb444dd155929e9632f5049251e4a8885989179fffb74ea6348a
fc216de5b5c2b370f0301381961e4223dfa533b4bfe7f7bd529a4d2140697169
fc23d4c58c5416bea5f8e58c97252284f0e5948b19f35121792868b0eda29d82
fdbad68e620cf08924f47ee9dba928382d4f1eb8adf7988d3807aa7f507a6efd