URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tell...
Submission: On September 16 via api from US — Scanned from DE

Summary

This website contacted 71 IPs in 5 countries across 55 domains to perform 367 HTTP transactions. The main IP is 192.0.66.2, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is www.mercurynews.com. The Cisco Umbrella rank of the primary domain is 118204.
TLS certificate: Issued by R3 on July 22nd 2023. Valid for: 3 months.
This is the only time www.mercurynews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
27 192.0.66.2 2635 (AUTOMATTIC)
2 13.32.27.92 16509 (AMAZON-02)
2 2606:4700::68... 13335 (CLOUDFLAR...)
8 2a00:1450:400... 15169 (GOOGLE)
2 2600:9000:223... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:214... 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 13.32.99.120 16509 (AMAZON-02)
16 18.66.147.118 16509 (AMAZON-02)
1 20.60.62.4 8075 (MICROSOFT...)
3 18.66.122.13 16509 (AMAZON-02)
1 18.66.100.58 16509 (AMAZON-02)
2 192.0.76.3 2635 (AUTOMATTIC)
2 2606:2800:133... 15133 (EDGECAST)
1 2a04:4e42:e00... 54113 (FASTLY)
1 52.37.28.33 16509 (AMAZON-02)
3 34.230.183.11 14618 (AMAZON-AES)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
9 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
73 151.101.129.44 54113 (FASTLY)
2 137.184.240.117 14061 (DIGITALOC...)
16 2a00:1450:400... 15169 (GOOGLE)
4 18.66.110.17 16509 (AMAZON-02)
1 3 142.250.186.38 15169 (GOOGLE)
4 98.98.134.243 21859 (ZEN-ECN)
2 2606:4700:440... 13335 (CLOUDFLAR...)
1 18.66.97.121 16509 (AMAZON-02)
8 2606:4700::68... 13335 (CLOUDFLAR...)
1 18.66.112.37 16509 (AMAZON-02)
1 35.244.174.68 15169 (GOOGLE)
4 35.190.38.143 15169 (GOOGLE)
8 2606:2800:233... 15133 (EDGECAST)
3 2a00:1450:400... 15169 (GOOGLE)
1 184.25.219.214 16625 (AKAMAI-AS)
2 2a02:2638:d::d 44788 (ASN-CRITE...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
2 99.86.4.128 16509 (AMAZON-02)
2 18.66.138.185 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 18.221.230.31 16509 (AMAZON-02)
1 2600:9000:225... 16509 (AMAZON-02)
1 143.204.215.73 16509 (AMAZON-02)
1 172.67.75.166 13335 (CLOUDFLAR...)
2 54.231.193.169 16509 (AMAZON-02)
1 52.216.218.137 16509 (AMAZON-02)
1 1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 13.32.99.122 16509 (AMAZON-02)
1 41.63.96.2 22822 (LLNW)
2 52.236.186.216 8075 (MICROSOFT...)
5 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
1 3 185.89.211.84 29990 (ASN-APPNEX)
4 2a00:1450:400... 15169 (GOOGLE)
4 23.216.77.18 20940 (AKAMAI-ASN1)
4 52.213.118.213 16509 (AMAZON-02)
24 151.139.128.10 20446 (STACKPATH...)
3 184.30.21.51 16625 (AKAMAI-AS)
4 13.85.16.224 8075 (MICROSOFT...)
3 6 107.178.250.234 396982 (GOOGLE-CL...)
3 2.16.97.41 16625 (AKAMAI-AS)
4 2.18.161.51 16625 (AKAMAI-AS)
3 52.7.177.4 ()
2 18.192.162.218 16509 (AMAZON-02)
11 141.226.228.48 ()
2 151.101.1.44 ()
2 213.202.235.9 ()
367 71
Apex Domain
Subdomains
Transfer
86 taboola.com
cdn.taboola.com — Cisco Umbrella Rank: 1069
pm-widget.taboola.com — Cisco Umbrella Rank: 3492
trc.taboola.com
trc-events.taboola.com
vidstat.taboola.com
am-trc-events.taboola.com
images.taboola.com
imprammp.taboola.com Failed
am-match.taboola.com
am-vid-events.taboola.com Failed
pips.taboola.com
cds.taboola.com Failed
3 MB
44 mercurynews.com
www.mercurynews.com — Cisco Umbrella Rank: 118204
a869.mercurynews.com — Cisco Umbrella Rank: 218847
session.mercurynews.com — Cisco Umbrella Rank: 254922
859 KB
24 flx10.com
tj6w5.flx10.com — Cisco Umbrella Rank: 119662
tqe36.flx10.com
k3vzn.flx10.com
369 KB
17 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 209
13619678.fls.doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 47
194 KB
15 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 105
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 152
71 KB
10 teads.tv
a.teads.tv — Cisco Umbrella Rank: 1535
sync.teads.tv — Cisco Umbrella Rank: 1515
t.teads.tv — Cisco Umbrella Rank: 2997
cdn2.teads.tv
141 KB
10 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 56
ajax.googleapis.com — Cisco Umbrella Rank: 419
maps.googleapis.com — Cisco Umbrella Rank: 425
256 KB
9 matheranalytics.com
js.matheranalytics.com — Cisco Umbrella Rank: 12264
www.i.matheranalytics.com
131 KB
9 gstatic.com
fonts.gstatic.com
225 KB
8 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 388
148 KB
8 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 337
config.aps.amazon-adsystem.com — Cisco Umbrella Rank: 675
aax.amazon-adsystem.com — Cisco Umbrella Rank: 418
68 KB
7 remixd.com
tags.remixd.com — Cisco Umbrella Rank: 22847
pubcast-files.remixd.com — Cisco Umbrella Rank: 24140
player-files.remixd.com — Cisco Umbrella Rank: 23075
60 KB
7 google.com
accounts.google.com — Cisco Umbrella Rank: 33
adservice.google.com — Cisco Umbrella Rank: 121
www.google.com — Cisco Umbrella Rank: 2
81 KB
4 azurewebsites.net
prod-dfm-proxy-connext.azurewebsites.net — Cisco Umbrella Rank: 52454
2 KB
4 clarium.io
protected-by.clarium.io — Cisco Umbrella Rank: 1566
973 B
4 moatads.com
js.moatads.com — Cisco Umbrella Rank: 27415
2 KB
4 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 221
227 KB
4 privacymanager.io
launchpad-wrapper.privacymanager.io — Cisco Umbrella Rank: 3580
launchpad.privacymanager.io — Cisco Umbrella Rank: 3339
geo.privacymanager.io — Cisco Umbrella Rank: 2187
18 KB
4 sitescout.com
pixel.sitescout.com — Cisco Umbrella Rank: 4043
458 B
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 63
366 KB
3 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 519
5 KB
3 google.de
adservice.google.de — Cisco Umbrella Rank: 12355
www.google.de — Cisco Umbrella Rank: 5677
1 KB
3 amazonaws.com
paywall-ad-bucket.s3.amazonaws.com — Cisco Umbrella Rank: 41768
ams-pageview-public.s3.amazonaws.com — Cisco Umbrella Rank: 13335
2 KB
3 czx5eyk0exbhwp43ya.biz
cdn.czx5eyk0exbhwp43ya.biz — Cisco Umbrella Rank: 40989
2 MB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 44
42 KB
3 azureedge.net
loader-cdn.azureedge.net — Cisco Umbrella Rank: 31258
fp-cdn.azureedge.net — Cisco Umbrella Rank: 49328
g2insights-cdn.azureedge.net — Cisco Umbrella Rank: 49015
73 KB
3 blueconic.net
digitalfirstmedia.blueconic.net — Cisco Umbrella Rank: 110541
2 KB
3 p-n.io
cdn.p-n.io — Cisco Umbrella Rank: 5267
k.p-n.io — Cisco Umbrella Rank: 3125
57 KB
2 exactag.com
m.exactag.com
1 KB
2 visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 912
281 B
2 pranmcpkx.com
cdn.pranmcpkx.com — Cisco Umbrella Rank: 31861
5 KB
2 criteo.com
gum.criteo.com — Cisco Umbrella Rank: 450
580 B
2 confiant-integrations.net
cdn.confiant-integrations.net — Cisco Umbrella Rank: 1463
117 KB
2 foo.software
www.foo.software — Cisco Umbrella Rank: 63929
199 B
2 unpkg.com
unpkg.com — Cisco Umbrella Rank: 1083
3 KB
2 msecnd.net
az416426.vo.msecnd.net — Cisco Umbrella Rank: 2515
44 KB
2 wp.com
stats.wp.com — Cisco Umbrella Rank: 2855
pixel.wp.com — Cisco Umbrella Rank: 2766
3 KB
2 osano.com
cmp.osano.com — Cisco Umbrella Rank: 5777
82 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 364
99 KB
2 htlbid.com
htlbid.com — Cisco Umbrella Rank: 11063
109 KB
1 basis.net
cdn01.basis.net — Cisco Umbrella Rank: 7200
2 KB
1 db-ip.com
api-mg2.db-ip.com — Cisco Umbrella Rank: 25464
782 B
1 jwplayer.com
cdn.jwplayer.com — Cisco Umbrella Rank: 2962
41 KB
1 thebrighttag.com
s.thebrighttag.com — Cisco Umbrella Rank: 2555
267 B
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 678
304 B
1 btstatic.com
s.btstatic.com — Cisco Umbrella Rank: 13996
13 KB
1 rlcdn.com
di.rlcdn.com — Cisco Umbrella Rank: 2320
98 B
1 scorecardresearch.com
sb.scorecardresearch.com — Cisco Umbrella Rank: 177
225 B
1 polyfill.io
polyfill.io — Cisco Umbrella Rank: 1646
683 B
1 parsely.com
cdn.parsely.com — Cisco Umbrella Rank: 3291
21 KB
1 windows.net
prodmg2.blob.core.windows.net — Cisco Umbrella Rank: 66134
144 KB
1 auth0.com
cdn.auth0.com — Cisco Umbrella Rank: 8056
38 KB
0 bidswitch.net Failed
x.bidswitch.net Failed
0 yahoo.com Failed
pr-bh.ybp.yahoo.com Failed
0 adsrvr.org Failed
match.adsrvr.org Failed
367 55
Domain Requested by
58 images.taboola.com
27 www.mercurynews.com www.mercurynews.com
cmp.osano.com
16 k3vzn.flx10.com
16 a869.mercurynews.com www.mercurynews.com
a869.mercurynews.com
cmp.osano.com
az416426.vo.msecnd.net
12 securepubads.g.doubleclick.net cmp.osano.com
securepubads.g.doubleclick.net
www.mercurynews.com
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
www.googletagservices.com
11 cdn.taboola.com cmp.osano.com
9 am-trc-events.taboola.com
9 fonts.gstatic.com fonts.googleapis.com
8 cdn.cookielaw.org cmp.osano.com
cdn.cookielaw.org
www.mercurynews.com
6 js.matheranalytics.com 3 redirects dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
6 tpc.googlesyndication.com cmp.osano.com
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
5 dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com cmp.osano.com
cdn.taboola.com
5 fonts.googleapis.com www.mercurynews.com
client
cmp.osano.com
4 tqe36.flx10.com tj6w5.flx10.com
4 t.teads.tv dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
4 prod-dfm-proxy-connext.azurewebsites.net www.mercurynews.com
4 tj6w5.flx10.com dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
www.mercurynews.com
4 protected-by.clarium.io www.mercurynews.com
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
4 js.moatads.com www.mercurynews.com
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
4 www.googletagservices.com www.mercurynews.com
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
4 pagead2.googlesyndication.com az416426.vo.msecnd.net
tpc.googlesyndication.com
www.googletagservices.com
4 pixel.sitescout.com www.mercurynews.com
13619678.fls.doubleclick.net
4 c.amazon-adsystem.com cmp.osano.com
c.amazon-adsystem.com
az416426.vo.msecnd.net
4 www.googletagmanager.com cmp.osano.com
4 maps.googleapis.com www.mercurynews.com
maps.googleapis.com
cmp.osano.com
3 www.i.matheranalytics.com dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
3 a.teads.tv dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
www.mercurynews.com
a.teads.tv
3 secure.adnxs.com 1 redirects www.mercurynews.com
3 www.google.com www.mercurynews.com
cmp.osano.com
3 player-files.remixd.com www.mercurynews.com
3 cdn.czx5eyk0exbhwp43ya.biz ajax.googleapis.com
cmp.osano.com
www.mercurynews.com
3 www.google-analytics.com cmp.osano.com
3 13619678.fls.doubleclick.net 1 redirects www.googletagmanager.com
adservice.google.com
3 digitalfirstmedia.blueconic.net cmp.osano.com
3 tags.remixd.com www.mercurynews.com
cmp.osano.com
tags.remixd.com
3 accounts.google.com www.mercurynews.com
cmp.osano.com
accounts.google.com
2 m.exactag.com
2 trc.taboola.com az416426.vo.msecnd.net
2 k.p-n.io cdn.p-n.io
2 sync.teads.tv www.mercurynews.com
2 dc.services.visualstudio.com az416426.vo.msecnd.net
2 geo.privacymanager.io launchpad.privacymanager.io
2 www.google.de www.mercurynews.com
2 paywall-ad-bucket.s3.amazonaws.com www.mercurynews.com
2 cdn.pranmcpkx.com cmp.osano.com
2 googleads.g.doubleclick.net cmp.osano.com
2 aax.amazon-adsystem.com c.amazon-adsystem.com
az416426.vo.msecnd.net
2 config.aps.amazon-adsystem.com cmp.osano.com
2 gum.criteo.com cmp.osano.com
www.mercurynews.com
2 pm-widget.taboola.com cmp.osano.com
2 cdn.confiant-integrations.net cmp.osano.com
2 www.foo.software www.mercurynews.com
2 unpkg.com 1 redirects www.mercurynews.com
2 az416426.vo.msecnd.net cmp.osano.com
2 cmp.osano.com www.mercurynews.com
cmp.osano.com
2 cdn.jsdelivr.net www.mercurynews.com
cdn.jsdelivr.net
2 htlbid.com www.mercurynews.com
1 pips.taboola.com az416426.vo.msecnd.net
1 am-match.taboola.com cmp.osano.com
1 vidstat.taboola.com cmp.osano.com
1 trc-events.taboola.com
1 cdn2.teads.tv dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
1 cdn01.basis.net 13619678.fls.doubleclick.net
1 adservice.google.de 1 redirects
1 ams-pageview-public.s3.amazonaws.com www.mercurynews.com
1 api-mg2.db-ip.com www.mercurynews.com
1 launchpad.privacymanager.io cmp.osano.com
1 cdn.jwplayer.com tags.remixd.com
1 g2insights-cdn.azureedge.net ajax.googleapis.com
1 fp-cdn.azureedge.net ajax.googleapis.com
1 s.thebrighttag.com cmp.osano.com
1 adservice.google.com 13619678.fls.doubleclick.net
1 geolocation.onetrust.com cdn.cookielaw.org
1 s.btstatic.com cmp.osano.com
1 loader-cdn.azureedge.net ajax.googleapis.com
1 pubcast-files.remixd.com tags.remixd.com
1 di.rlcdn.com www.mercurynews.com
1 sb.scorecardresearch.com www.mercurynews.com
1 launchpad-wrapper.privacymanager.io cmp.osano.com
1 pixel.wp.com www.mercurynews.com
1 session.mercurynews.com www.mercurynews.com
1 polyfill.io cmp.osano.com
1 stats.wp.com www.mercurynews.com
1 cdn.parsely.com www.mercurynews.com
1 prodmg2.blob.core.windows.net www.mercurynews.com
1 cdn.p-n.io www.mercurynews.com
1 cdn.auth0.com www.mercurynews.com
1 ajax.googleapis.com www.mercurynews.com
0 cds.taboola.com Failed az416426.vo.msecnd.net
0 x.bidswitch.net Failed am-match.taboola.com
0 pr-bh.ybp.yahoo.com Failed am-match.taboola.com
0 match.adsrvr.org Failed am-match.taboola.com
0 am-vid-events.taboola.com Failed
0 imprammp.taboola.com Failed cmp.osano.com
367 94
Subject Issuer Validity Valid
mercurynews.com
R3
2023-07-22 -
2023-10-20
3 months crt.sh
htlbid.com
Amazon RSA 2048 M01
2023-02-21 -
2023-11-19
9 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-02 -
2024-05-01
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
cmp.osano.com
Amazon RSA 2048 M02
2023-02-21 -
2023-09-30
7 months crt.sh
*.auth0.com
Amazon RSA 2048 M01
2023-02-24 -
2024-03-24
a year crt.sh
accounts.google.com
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
pushlycdn.com
Amazon RSA 2048 M02
2023-02-27 -
2024-02-13
a year crt.sh
s762.pressenterprise.com
Amazon RSA 2048 M02
2023-02-21 -
2023-11-02
8 months crt.sh
*.blob.core.windows.net
Microsoft RSA TLS CA 01
2023-03-20 -
2024-03-20
a year crt.sh
*.remixd.com
Amazon RSA 2048 M02
2023-02-09 -
2024-03-09
a year crt.sh
*.parsely.com
Amazon RSA 2048 M02
2023-05-06 -
2024-06-03
a year crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA
2022-11-14 -
2023-12-15
a year crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA
2023-05-05 -
2024-04-28
a year crt.sh
polyfill.io
Certainly Intermediate R1
2023-09-13 -
2023-10-13
a month crt.sh
*.mercurynews.com
Amazon RSA 2048 M01
2023-03-30 -
2024-04-28
a year crt.sh
*.blueconic.net
Amazon RSA 2048 M01
2023-06-08 -
2024-07-06
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1
2022-12-08 -
2023-12-31
a year crt.sh
www.foo.software
Go Daddy Secure Certificate Authority - G2
2022-12-29 -
2024-01-30
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
c.amazon-adsystem.com
Amazon RSA 2048 M01
2023-02-28 -
2024-02-17
a year crt.sh
*.doubleclick.net
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
*.sitescout.com
GeoTrust Global TLS RSA4096 SHA256 2022 CA1
2023-01-09 -
2024-02-02
a year crt.sh
confiant-integrations.net
GTS CA 1P5
2023-07-23 -
2023-10-21
3 months crt.sh
*.privacymanager.io
Amazon RSA 2048 M01
2023-07-27 -
2024-08-24
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2023-04-01 -
2024-03-31
a year crt.sh
*.scorecardresearch.com
Sectigo RSA Domain Validation Secure Server CA
2022-12-15 -
2023-12-28
a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2023-02-02 -
2024-03-03
a year crt.sh
pubcast-files.remixd.com
GTS CA 1D4
2023-07-22 -
2023-10-20
3 months crt.sh
s.btstatic.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-01-30 -
2024-02-20
a year crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-19 -
2023-10-18
3 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-12-13 -
2023-12-13
a year crt.sh
config.aps.amazon-adsystem.com
Amazon RSA 2048 M02
2023-02-20 -
2024-03-20
a year crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com
Amazon RSA 2048 M01
2023-03-16 -
2024-03-08
a year crt.sh
*.google.com
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
signal.co
Entrust Certification Authority - L1K
2023-02-10 -
2024-02-10
a year crt.sh
snibe7egl.wpc.edgecastcdn.net
DigiCert TLS RSA SHA256 2020 CA1
2023-01-03 -
2024-02-03
a year crt.sh
jwplayer.com
Amazon RSA 2048 M02
2023-03-01 -
2023-12-25
10 months crt.sh
sni2bf2agl.wpc.edgecastcdn.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-09-03 -
2024-10-03
a year crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01
2023-03-21 -
2023-12-19
9 months crt.sh
player-files.remixd.com
GTS CA 1D4
2023-07-30 -
2023-10-28
3 months crt.sh
www.google.com
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
www.google.de
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
cdn01.basis.net
GeoTrust TLS RSA CA G1
2023-05-30 -
2024-06-15
a year crt.sh
in.applicationinsights.azure.com
Microsoft Azure RSA TLS Issuing CA 03
2023-09-02 -
2024-08-27
a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3
2023-08-14 -
2023-11-06
3 months crt.sh
a248.e.akamai.net
DigiCert TLS RSA SHA256 2020 CA1
2023-05-16 -
2024-05-15
a year crt.sh
protected-by.clarium.io
Amazon RSA 2048 M02
2022-12-16 -
2024-01-14
a year crt.sh
tj6w5.flx10.com
R3
2023-07-28 -
2023-10-26
3 months crt.sh
teads.tv
R3
2023-09-13 -
2023-12-12
3 months crt.sh
*.azurewebsites.net
Microsoft Azure TLS Issuing CA 01
2023-08-01 -
2024-06-27
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
www.i.matheranalytics.com
Amazon RSA 2048 M01
2023-03-02 -
2024-01-13
10 months crt.sh
*.p-n.io
Amazon RSA 2048 M01
2023-02-10 -
2024-01-21
a year crt.sh
*.exactag.com
Sectigo RSA Organization Validation Secure Server CA
2023-04-03 -
2024-05-03
a year crt.sh
tqe36.flx10.com
R3
2023-07-28 -
2023-10-26
3 months crt.sh
k3vzn.flx10.com
R3
2023-07-28 -
2023-10-26
3 months crt.sh

This page contains 23 frames:

Primary Page: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Frame ID: 3C297C7A291A80AE776742E7669BC5D8
Requests: 270 HTTP requests in this frame

Frame: https://cmp.osano.com/
Frame ID: 8FDB6839FE923A4A962C87B6DAC7288B
Requests: 1 HTTP requests in this frame

Frame: https://13619678.fls.doubleclick.net/activityi;dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Frame ID: 9B21F911CA9FC44BF16F1678ED898FAB
Requests: 1 HTTP requests in this frame

Frame: https://pixel.sitescout.com/dmp/asyncPixelSync
Frame ID: C7E4170D22F02FEA0BF1DE083E32BC8D
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Frame ID: CF6998EC434DC7A442C5CD6381BC2D8B
Requests: 1 HTTP requests in this frame

Frame: https://cdn.jwplayer.com/libraries/FUtg69tL.js
Frame ID: D28E0E7D62778CC877EF0563B9294064
Requests: 7 HTTP requests in this frame

Frame: https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Frame ID: 23E26107437A541E109C8538078E0A7C
Requests: 3 HTTP requests in this frame

Frame: https://pixel.sitescout.com/dmp/asyncPixelSync
Frame ID: BE46D480E531E727D49D658190244C42
Requests: 1 HTTP requests in this frame

Frame: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 130D9BAEDB318291CD4BEDFB69EA798A
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 433B172E24C4216656B13A98E0271C9A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: DEA070E3C026C9409567AD7BE3795FE9
Requests: 2 HTTP requests in this frame

Frame: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: CBD4AC82B1926DD3DB44FCAA38BFCA9C
Requests: 12 HTTP requests in this frame

Frame: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: F8E6593D559821CA592D2BF2DF3AFCB7
Requests: 11 HTTP requests in this frame

Frame: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 68615C00EBE4BB9C60745D4CC4B29874
Requests: 19 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssGBmkrjWWRl6sUgt02hNhrtZXf6UNXvn0JldtsNMqVDjVoD3cqK5lk-KGScUqxElOQfBAYt2PDqSGi8V0D7ZuGLHYfrgLT12Iw6irW3TMKol-9e_5xWuYRrzqlnCa4rwKvExMQZaS9ecHR6s2smNPMkk6t1qnZrvNdblpc3fmwBdqkmbsLULdLtlJDhAVd2LLMctLVtPRhPmXB2Vey8f88heD32lRTE2T3lcUYpXI98bRZbMIsnsCDERK2Y07gQEViAus7t1ke17EcRKizO4R8ItHZBblsGIomvPz_f_wIO-GREiAFZ5wUXsIV8CmPMb8lAnWVpmSkpoxpA3Uio1sbyoNdkaP7Jllm_sGQQHQtRNzKtKbdXfe3xf2dXjqZhP7097fAXVg&sai=AMfl-YRzRHgtS1aZT0GBOhPHGWz_VtphLBO11DspojaNDqlhSzFGjSCbY9FdBh1mL70ZRF9TJ649WniZ_iWP-aP7yq92KrtOi93Rla6Ojw&sig=Cg0ArKJSzB_c_mVsXqweEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: F5E448E905D63776E8B7488AFCE28B69
Requests: 9 HTTP requests in this frame

Frame: https://sync.teads.tv/wigo-no-slot
Frame ID: 0411174542C3756423E23F1D63CE6A49
Requests: 1 HTTP requests in this frame

Frame: https://sync.teads.tv/iframe?pid=130377&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-sf&auctid=6e33ffb7-03e6-4184-a074-aa9a12c3cd8f&us_privacy=1---&1694888539254
Frame ID: 8926761A3FB3C270EE63BE56E163A936
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: FA7A9917B047722EB648B2871F838ECB
Requests: 1 HTTP requests in this frame

Frame: https://tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/320x50/?cacheBuster=1984593769&destUrl=https%3A%2F%2Fwww.bestinsv.com%2F%3Futm_source%3Dbang%26utm_medium%3Dbanner&clickTracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvkiQ7D7KFxM4264W1Cyahqox5onN5PFF9o4rrm_gc7w_CK3KYRcDyrdUDHPbn3mh4hBVNAAmuYnDdxLy7BShhDAsN4K0_tu0bRthhSq5Bqi4wjrarZlZw03pdp2D-axevZIUSoSQBcIMx6J7qydOJRH5RzRRGx1_GVGF4mfa0AxCHeMx-7ZPkKcYpEDnquILrjU8uYbno83LBP-eOnIjftAVRZrzEHSYKQxIuUlVDAIiV8zIY8OGQv1bLTwvY9TOmabeffsI9717i884nKTrUxJypG3zi6mFqlBMRWaw_J2y7KNA96mOWkjS7W-3z4gHdGkiSG_K0DoLGR1pEkkiVRRfXS8X7ulhmvoHUU-CzNcSDw2_o7Tk8Pb4ywbkDv%26sai%3DAMfl-YRELPywSbkwYLDBBDrkZ3DQmPxiVMZdr-NJLNhNpKz2AmoqZpBzyQOy-zrBLStY-o5I908TyjZqM2cX0Q57PQ-2dx9n69vfQmC8-g%26sig%3DCg0ArKJSzHlXSFUPLDV4EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D
Frame ID: AA29E4AD7AD3642C839E8FDE1C45E904
Requests: 11 HTTP requests in this frame

Frame: https://tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/728x90/?cacheBuster=15259304&destUrl=https%3A%2F%2Fwww.bestinsv.com%2F%3Futm_source%3Dbang%26utm_medium%3Dbanner&clickTracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstvqDF631KgJowHOx64xtxkaTMIlZz-YrB-YgqIcv0iMw-qu_Lc6Qex_t2idlV2DasQwk1uRGGWIhEg66_-q0woZcgiHRjGyZsgAxu2UD37YzmUdVXfS48eGeG860ducc7decPlB-Lq3xRzHO2xchzyw4s6kjpX7P6mMqup8b2xcW72Z2w_5k3QkXv1qbmb42keqom8Gsmb-EzdrRvO94kTe8cNHrtDu9jT0XEVQTP7yfpzoz24GJi23hOBIdX9ySCsQfl6SsvlvKBA2bBXfdj8D4lS2KKB2-wT5LEzqCxyO1tgWjfOoJzsJGDpiXGavuSOUO6jxbDIens7DKl8JhKYKWlUUngZCpPeUa-Lo5IWZpp4zNI-QtcRg57REgHaILo%26sai%3DAMfl-YTGOz2iUN4lIZsSU0FWZnrqtDFlXALtA77XmD9TvvEsut78UD3JMTSyiqXmW7Qcuqr6NXn_DZAvTC2im78SVXUJ0t5DBmMydjYqgQ%26sig%3DCg0ArKJSzPbuen0I_JexEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D
Frame ID: 3702567B8B2C5AE1039B1733396AE284
Requests: 11 HTTP requests in this frame

Frame: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: F1DEDBB10784A9F5D0DE2001EEFA12BA
Requests: 1 HTTP requests in this frame

Frame: https://imprammp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8aGYCLAaobr5060Z7yxFQ3Xzp1o32lisAAABgYID-AAlsJs7hyuZwa4y7mVu0ci7WypFzsJZNNjbDarabeSYOIyCBzcQ5XNkcbo1xN3OLVs7FWjlyDtayycZmWM12M8_EYQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awCA4oBQlrPD7nPZ_QEAAAAABAAAAAAJAISW5xIALyOZJ_7_________YwzQZ97I-P___79h0APgwQfAgxAAAICPISoSNUNKkJhXRApOizACAAAAEPVVwHJkkk5Qsajy___fbwXgCgBAgOKnTu1wFt1BibcwAAAABGMW6GHx-80Ou8bvdpn_________fzP_Z_7RCBlxpaQJggEAUPMLCACw5hcQAICNugEAeBMAJ-gQtGIwWJ2AmB0AAACAO_____96QMQzG81Wi5HN4Vl4nCvnyDlxTFyuwcY3WvhGFt_2JFUdUyKRd3f2CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYrEboIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBCO74cKyMi7cIpPJ4haNRsa1cuXarEUe33Az8owmM-NkLXp9TBebzbcbWbxIMGBxL5KnRToRDFe7lXNjWXicM4vJuFq4VpvJYmXxDBab0WIzsoglmpNFOpFd9hXPbDRbLUY2h2fhca6cI-fEMXG5BhvfaOEbWXz7ym64sKyMC7fIZLK4RaORca1cuTZrkcc33Iw8o8nMOFmLXh_TxWbz7UYWf2O2HA2Hw9VmuW_MlqPhcLjaLPcdOsN39TkbpZOl2COUGbfZ2_DmNChcBov3JzEtpt3ZwfP7HZ0yWy1Z1Bn9fr_f7_f7_X6_36D1HMwGhW-ZFirPfa_lHNM-DGKDQRFLBBfpRO0yOR12l-_zs_xdh7faZfm4Ls-7y_e5iCVK00U60UsGk81eMNtLBnu1y2d02N1qh-VrdrlVDsvdZXKr_ZaXW3R02N2io8ute7m8dpNb5re8pa7P6a2YrIV-1-Xz1v0tX7fK-NYc_qanzflWGV8et-hlNnveEovHIpYIThfpRPQyni7qP1LAxVy5mqvmotEqAQAAAAAAAABYgmmmmwAAAAA4GdRmNlis1ulgBsPlZrBaLoAK9RpdP27a779Ukty76qsuGrc9veCLNfaYRrtMTofd5fv8LH_X4a12WT6uy_Pu8n2uDKAi_YfZZp8RxFqtljUAAAABbAAAAAHcdONNQJgV9____z8OAAAggBx6AAAA9PuAoMj1wo9cKfgVxGA1nOwfgAqxVqvV7cZarVZAAlntlhP4____Dw!&cmcv=&pix=undefined&cb=1694888542095&uv=3340&tms=1694888542095&abt=nonrv_vA!rv0lcr_vA!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=03b98efa-c87f-4e91-9d90-62cf0567f3ba&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Frame ID: 3D9ABBB3376746DB4932DE462FFB28DB
Requests: 1 HTTP requests in this frame

Frame: https://am-match.taboola.com/sync?dast=V8aGYCLAaobr5060Z7yxFQ3Xzp1o32lisAAABgYID-AAlsJs7hyuZwa4y7mVu0ci7WypFzsJZNNjbDarabeSYOIyCBzcQ5XNkcbo1xN3OLVs7FWjlyDtayycZmWM12M8_EYQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awCA4oBQlrPD7nPZ_QEAAAAABAAAAAAJAISW5xIALyOZJ_7_________YwzQZ97I-P___79h0APgwQfAgxAAAICPISoSNUNKkJhXRApOizACAAAAEPVVwHJkkk5Qsajy___fbwXgCgBAgOKnTu1wFt1BibcwAAAABGMW6GHx-80Ou8bvdpn_________fzP_Z_7RCBlxpaQJggEAUPMLCACw5hcQAICNugEAeBMAJ-gQtGIwWJ2AmB0AAACAO_____96QMQzG81Wi5HN4Vl4nCvnyDlxTFyuwcY3WvhGFt_2JFUdUyKRd3f2CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYrEboIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBCO74cKyMi7cIpPJ4haNRsa1cuXarEUe33Az8owmM-NkLXp9TBebzbcbWbxIMGBxL5KnRToRDFe7lXNjWXicM4vJuFq4VpvJYmXxDBab0WIzsoglmpNFOpFd9hXPbDRbLUY2h2fhca6cI-fEMXG5BhvfaOEbWXz7ym64sKyMC7fIZLK4RaORca1cuTZrkcc33Iw8o8nMOFmLXh_TxWbz7UYWf2O2HA2Hw9VmuW_MlqPhcLjaLPcdOsN39TkbpZOl2COUGbfZ2_DmNChcBov3JzEtpt3ZwfP7HZ0yWy1Z1Bn9fr_f7_f7_X6_36D1HMwGhW-ZFirPfa_lHNM-DGKDQRFLBBfpRO0yOR12l-_zs_xdh7faZfm4Ls-7y_e5iCVK00U60UsGk81eMNtLBnu1y2d02N1qh-VrdrlVDsvdZXKr_ZaXW3R02N2io8ute7m8dpNb5re8pa7P6a2YrIV-1-Xz1v0tX7fK-NYc_qanzflWGV8et-hlNnveEovHIpYIThfpRPQyni7qP1LAxVy5mqvmotEqAQAAAAAAAABYgmmmmwAAAAA4GdRmNlis1ulgBsPlZrBaLoAK9RpdP27a779Ukty76qsuGrc9veCLNfaYRrtMTofd5fv8LH_X4a12WT6uy_Pu8n2uDKAi_YfZZp8RxFqtljUAAAABbAAAAAHcdONNQJgV9____z8OAAAggBx6AAAA9PuAoMj1wo9cKfgVxGA1nOwfgAqxVqvV7cZarVZAAlntlhP4____Dw!&excid=22&docw=0&cijs=1&nlb=false
Frame ID: EBEC2ACA521C1D83DF3724BDCB7AADEC
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Meghan Markle earned more than The Weeknd for '12 hours work': SpotifyBack ButtonSearch IconFilter IconGroup 3Group 3Group 3Group 3

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • //maps\.google(?:apis)?\.com/maps/api/js

Overall confidence: 100%
Detected patterns
  • accounts\.google\.com/gsi/client

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • tpc\.googlesyndication\.com/safeframe

Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • moatads\.com

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • /polyfill\.min\.js

Overall confidence: 100%
Detected patterns
  • //s\.btstatic\.com/tag\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

367
Requests

89 %
HTTPS

38 %
IPv6

55
Domains

94
Subdomains

71
IPs

5
Countries

8851 kB
Transfer

20625 kB
Size

21
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43
  • https://unpkg.com/web-vitals@3/dist/web-vitals.iife.js HTTP 302
  • https://unpkg.com/web-vitals@3.4.0/dist/web-vitals.iife.js
Request Chain 72
  • https://13619678.fls.doubleclick.net/activityi;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F HTTP 302
  • https://13619678.fls.doubleclick.net/activityi;dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Request Chain 131
  • https://adservice.google.de/ddm/fls/i/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F HTTP 302
  • https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Request Chain 186
  • https://secure.adnxs.com/ttj?id=28334192 HTTP 307
  • https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D28334192
Request Chain 218
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1635 HTTP 301
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Request Chain 219
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1635 HTTP 301
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Request Chain 220
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1635 HTTP 301
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js

367 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
165 KB
36 KB
Document
General
Full URL
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx / WordPress VIP <https://wpvip.com>
Resource Hash
6d473c042c8d4d5dc49e13bdee4ddfbfdfdb16835d4ee23f363b3ff608e08d0c
Security Headers
Name Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
0
cache-control
max-age=300, must-revalidate
content-encoding
gzip
content-security-policy
default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
content-type
text/html; charset=UTF-8
date
Sat, 16 Sep 2023 18:22:12 GMT
host-header
a9130478a60e5f9135f765b23f26593b
link
<https://www.mercurynews.com/wp-json/>; rel="https://api.w.org/" <https://www.mercurynews.com/wp-json/wp/v2/posts/9968021>; rel="alternate"; type="application/json" <https://wp.me/p7ShJJ-FP8x>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000;includeSubdomains
vary
Accept-Encoding
x-cache
miss
x-hacker
If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by
WordPress VIP <https://wpvip.com>
x-rq
hhn2 85 187 443
htlbid.css
htlbid.com/v3/mercurynews.com/
3 KB
685 B
Stylesheet
General
Full URL
https://htlbid.com/v3/mercurynews.com/htlbid.css?ver=6.3.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-92.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2f218961fc995f27f5868268ca3f765d4e7066eb6144139ce5b9eefe9b9ad443

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:15:51 GMT
content-encoding
br
via
1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
last-modified
Mon, 05 Jun 2023 22:43:44 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-C2
age
382
x-amz-server-side-encryption
AES256
etag
W/"d0ed30e2f703616022754e56fc09aa63"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
cache-control
max-age=600
x-amz-cf-id
Csw6Z6w16HW5P7cDLwpHmDmJarmMn0t8kivhTy4KvkdGhvCp5g4Trg==
style.css
www.mercurynews.com/wp-content/client-mu-plugins/src/Sitemap/includes/
880 B
439 B
Stylesheet
General
Full URL
https://www.mercurynews.com/wp-content/client-mu-plugins/src/Sitemap/includes/style.css?m=1670265514g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c540cdeba4eb897beea1c93c6452269a4de7b86a2e670b5b0ad37f9bbfc78c53
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 05 Dec 2022 18:38:34 GMT
server
nginx
x-rq
hhn2 85 188 443
etag
W/"638e3aaa-370"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
/
www.mercurynews.com/_static/
31 KB
5 KB
Stylesheet
General
Full URL
https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsosTcXsRv6XLOhts09Kk+Ptuq0/CwLdLwkkuvLPBxOpYIYf6JBaYQkrRLKmYXKdA4l0RyEkUUFro1nCCf6k4W9DvuMVDPi/RaKmihngmtJo2rlYJd/676yLx4TG//no5hr1J899RK4ebfMR7fxsu49Bfx/MHV0hlFw==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0f27b15848fb3a09df5fa1ba8e2ae9a80ca73faca61455767cd28318fd3c2c6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 04 Jan 2023 22:31:20 GMT
server
nginx
x-rq
hhn2 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
mng-digisubs.styles.css
www.mercurynews.com/wp-content/plugins/mng-digisubs/static/
14 KB
5 KB
Stylesheet
General
Full URL
https://www.mercurynews.com/wp-content/plugins/mng-digisubs/static/mng-digisubs.styles.css?ver=6.3.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e136a43275cfd6956929800912432b8d7131f1c05dfdd9902fd3bbfd1ee2956b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Fri, 15 Sep 2023 22:04:35 GMT
server
nginx
x-rq
hhn2 85 188 443
etag
W/"6504d4f3-395f"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
/
www.mercurynews.com/_static/
848 B
446 B
Stylesheet
General
Full URL
https://www.mercurynews.com/_static/??/wp-content/plugins/site-plugins/site-bang/static/css/screen.min.css,/wp-content/client-mu-plugins/src/Ads/assets/css/mobile-adhesion-style.css?m=1672871480
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
af791f4ecfb200dd519a03dc1760721fd4fc36cd3ef9f0b5caf592f9a3d49b91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 04 Jan 2023 22:31:20 GMT
server
nginx
x-rq
hhn2 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
bootstrap-icons.min.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/
56 KB
9 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
5922713
x-jsd-version
1.5.0
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230021-FRA, cache-yyz4567-YYZ
x-jsd-version-type
version
server
cloudflare
etag
W/"e199-MKfLdwDci4zij+cy307LMP/uJk4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A1fNDf2iTNc%2FEHjTTCkdClW3WYAGGjl5zxdBeoB7jjrM5W%2F91wB9BIofzPjgZQ0L4v1X9m93mQXq71Qo9FZ%2Bhu3fdmkzOFP7UpqIl9RT2TzureoF15%2FC5TkPVHQas0wR%2FM1ZcSyliqFRTkQNzto%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
807b2231aa714d8f-FRA
css
fonts.googleapis.com/
4 KB
953 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.3.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
9d7dc41759aab2379209357a1c1afd9607a7278357e914d3b9125f0a79b399c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 16 Sep 2023 18:17:03 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 16 Sep 2023 18:22:12 GMT
/
www.mercurynews.com/_static/
111 KB
27 KB
Stylesheet
General
Full URL
https://www.mercurynews.com/_static/??-eJyVj9EKwjAMRX/ILJtYxQfxU6SkcVTbppiUsb93AwV907fcC+dwg1MFkmJcDGtqYyyK4ZrBB8gSFNW8RULS5aQHc+lyLN0SN/hB5gZv+MZWPd1h2HYOF0VLrDjFMLIpmlSoorZ658Q/ey6xEKpQ9AmSjKJf4a9J6yevYmXO+TTsjzvnDq7vn3OqYSA=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
57da29f239e3a7666bd246c66b55872bf8e6e36c1683695dc772d143631f528c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 12 Sep 2023 22:25:00 GMT
server
nginx
x-rq
hhn2 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
osano.js
cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/
354 KB
81 KB
Script
General
Full URL
https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:600:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
006c6ebd759be0b1f7879a1c5a6a7b90526d18f97c0f13de07a18895603516d8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Thu, 03 Aug 2023 00:04:20 GMT
content-encoding
br
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
3867472
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
81759
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 02 Aug 2023 21:57:03 GMT
server
CloudFront
etag
"2af6aaf8add1917cce921a3d1a67cec5"
x-frame-options
SAMEORIGIN
vary
Origin
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=86400, s-maxage=86400, must-revalidate, proxy-revalidate, no-transform
x-amz-cf-id
QYXwVolag5rpmkXwg4tMm_VCi3ufhAD2ZbWO3B-IBcp01CFnHZPpoQ==
htlbid.js
htlbid.com/v3/mercurynews.com/
400 KB
109 KB
Script
General
Full URL
https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.3.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-92.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
726072642d7ac63adb4f7dd891cbb3fd56ed23b825e2fc64f3fec029e372693e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
br
via
1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
last-modified
Mon, 05 Jun 2023 22:43:44 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-C2
x-amz-server-side-encryption
AES256
etag
W/"19fe31e40e621db88498bc266f8f8880"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
cache-control
max-age=600
x-amz-cf-id
wrK75X0pB8HGP3w3b3mGtDpkUAtnocslEHzqbqKVm7G3ovonoA5i6Q==
sso-tools.min.js
www.mercurynews.com/wp-content/client-mu-plugins/src/SSO/assets/js/
5 KB
1 KB
Script
General
Full URL
https://www.mercurynews.com/wp-content/client-mu-plugins/src/SSO/assets/js/sso-tools.min.js?m=1670265514g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
feb0e7f17014201ea9124f23e3f63965411385abf0103fc682595d0674087a0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 05 Dec 2022 18:38:34 GMT
server
nginx
x-rq
hhn2 85 188 443
etag
W/"638e3aaa-1536"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/
87 KB
88 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Mon, 11 Sep 2023 19:13:47 GMT
x-content-type-options
nosniff
age
428905
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
89476
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 10 Sep 2024 19:13:47 GMT
loader.min.js
www.mercurynews.com/wp-content/plugins/loader-wp/static/
19 KB
6 KB
Script
General
Full URL
https://www.mercurynews.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.8
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
55ae555c3de73491aeff78da9644886ef48e990ef46e73b9206e741a1a89ef92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 11 Jul 2023 03:56:40 GMT
server
nginx
x-rq
hhn2 85 187 443
etag
W/"64acd2f8-4c3d"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
global.js
www.mercurynews.com/wp-content/plugins/bloom-for-publishers/lib/js/
14 KB
9 KB
Script
General
Full URL
https://www.mercurynews.com/wp-content/plugins/bloom-for-publishers/lib/js/global.js?m=1672871479g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
041f41b6b98e101febe7d24b8d7fdd9fd696dabad0fbe296c978272491c2a791
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 04 Jan 2023 22:31:19 GMT
server
nginx
x-rq
hhn2 85 188 443
etag
W/"63b5fe37-3985"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
js
maps.googleapis.com/maps/api/
173 KB
60 KB
Script
General
Full URL
https://maps.googleapis.com/maps/api/js?key=AIzaSyDJUi9DGZnqI8YbyBueZXiiJjKzw9kGDlE&ver=6.3.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
65e4475c9ad5a54ecdf6590313e8c380af2e1caf16bc4b9b3e9fbdf7b173a7f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Accept-Language, Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
60869
x-xss-protection
0
auth0-spa-js.production.js
cdn.auth0.com/js/auth0-spa-js/1.13/
105 KB
38 KB
Script
General
Full URL
https://cdn.auth0.com/js/auth0-spa-js/1.13/auth0-spa-js.production.js?ver=6.3.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:f000:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
6AzkYKZDwDnSxmQe5SqIWFlWTPBMtbyI
content-encoding
gzip
via
1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront)
date
Sat, 16 Sep 2023 17:33:17 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains
x-amz-cf-pop
FRA53-C1
age
2937
x-cache
Hit from cloudfront
x-amz-replication-status
FAILED
last-modified
Thu, 07 Jan 2021 14:32:49 GMT
server
AmazonS3
etag
W/"8bea9e0d733d097381a1b5eb8c40983d"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=10800,public
x-robots-tag
noindex
x-amz-cf-id
xJT-pTo8LuAJI3nxJ52Y4jgQixWxOCAsGQpARzXlAR-Z0OBf6GfEOg==
client
accounts.google.com/gsi/
197 KB
78 KB
Script
General
Full URL
https://accounts.google.com/gsi/client?ver=6.3.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
866768efa051d0eaedf6cf4deca40571ee594a591992a51c7bf7de4a34cb78c1
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-MB8KBbG9oaSPSGQjhdpysA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-security-policy
script-src 'report-sample' 'nonce-MB8KBbG9oaSPSGQjhdpysA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
application/javascript; charset=utf-8
cache-control
private, max-age=1800
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Sat, 16 Sep 2023 18:22:12 GMT
/
www.mercurynews.com/_static/
335 KB
106 KB
Script
General
Full URL
https://www.mercurynews.com/_static/??-eJyl0D0KwzAMBeAL1RaBpD9D6dpr2IkwMpYaKpn2+HWGQDMVmkno8fQNgtfsxocYisFcaiJRYEluokRao4JaMBo3medA4mOVqaDPeoB/jHYg+La9TCuTFeQ2da9V6R4W4PkDUjJ0myUGSSuZvzLP7VFZb3ztjpf+3A39acgf2GmLYg==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a69fb09b92c810ffc31ce707038f15a90f62e0583d1bfc0485daf231cf3551ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Fri, 15 Sep 2023 22:04:35 GMT
server
nginx
x-rq
hhn2 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
pushly-sdk.min.js
cdn.p-n.io/
274 KB
57 KB
Script
General
Full URL
https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.3.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-120.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c5cfcd9ec414a81b822e86f4976a78abb71176739e963d4c64484f82bcbfa09f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:18:20 GMT
content-encoding
gzip
via
1.1 cb605905cea2427f1d9f13acc778e822.cloudfront.net (CloudFront)
last-modified
Thu, 14 Sep 2023 18:20:17 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P3
age
293
x-amz-server-side-encryption
AES256
etag
W/"d7bf39e56888caf6be6e2ad41c0a39fa"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=900
x-amz-cf-id
ltTWtWuC8DuXwyaak3MbepobSG6m38z8nGzqxRd3fm9fZRPzSiuuUw==
dfm-pushly.min.js
www.mercurynews.com/wp-content/plugins/dfm-pushly/static/js/
160 B
228 B
Script
General
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-pushly/static/js/dfm-pushly.min.js?m=1689051011g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
hhn2 85 188 443
last-modified
Tue, 11 Jul 2023 04:50:11 GMT
server
nginx
etag
"64acdf83-a0"
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
160
script.js
a869.mercurynews.com/
149 KB
44 KB
Script
General
Full URL
https://a869.mercurynews.com/script.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
0b3e489a84163694681634cba6001a3d86117a6b5c0432dc8308fe82f0dc1f3c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:14:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
age
433
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
44499
x-xss-protection
1; mode=block
last-modified
Sat, 16 Sep 2023 18:14:06 GMT
server
-
etag
90db430c0d03373d2574a2bbe4605fc5
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=600
x-robots-tag
noindex, nofollow
x-amz-cf-id
LHKWD3P_cyddyLQMRZW6uQNw8KhU-PoJueW7Cdj3PR7Cmr1hIrfjjA==
expires
Sat, 16 Sep 2023 18:24:59 GMT
mg2nw.min.js
prodmg2.blob.core.windows.net/newsletterwidget/mngcep/
143 KB
144 KB
Script
General
Full URL
https://prodmg2.blob.core.windows.net/newsletterwidget/mngcep/mg2nw.min.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.60.62.4 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0373fc5a47c238cf139494574b7ddb8c586f81aad7e10de930b6a2d0b3cf4d5b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 16 Sep 2023 18:22:12 GMT
Last-Modified
Wed, 09 Aug 2023 10:01:19 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
2/l8aJuCHt/f1DSv/q9TlQ==
ETag
0x8DB98BF945D9B3B
Content-Type
application/javascript
Access-Control-Allow-Origin
*
x-ms-request-id
fd3c5c94-e01e-0029-2aca-e8c9ca000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
Content-Length
146402
/
www.mercurynews.com/_static/
53 KB
18 KB
Script
General
Full URL
https://www.mercurynews.com/_static/??/wp-content/plugins/dfm-ad-mods/static/js/hhsl-check.min.js,/wp-content/plugins/mng-digisubs/static/mng-digisubs.articleShare.bundle.js?m=1694815475j
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d873f234380734f74e852b1f25a35b0ddb23a5336da1f32cd4cf4239f6fa2d41
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Fri, 15 Sep 2023 22:04:35 GMT
server
nginx
x-rq
hhn2 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
boldcoastal.css
www.mercurynews.com/wp-content/themes/assets/static/css/
642 KB
163 KB
Stylesheet
General
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/css/boldcoastal.css?ver=1694815481
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9b40cfdc0fab43f2b7bb1d00fa1f5982cd650a25dbab95320bd43e8256865e8d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Fri, 15 Sep 2023 22:04:35 GMT
server
nginx
x-rq
hhn2 85 187 443
etag
W/"6504d4f3-a09e3"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
mn-logo.svg
www.mercurynews.com/wp-content/uploads/2020/09/
12 KB
5 KB
Image
General
Full URL
https://www.mercurynews.com/wp-content/uploads/2020/09/mn-logo.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 23 Sep 2020 17:38:16 GMT
server
nginx
x-rq
hhn2 109 195 443
etag
W/"497950346404e2d1"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=31536000
index.js
tags.remixd.com/player/v5/
34 KB
10 KB
Script
General
Full URL
https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-13.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:21:26 GMT
content-encoding
gzip
via
1.1 fce673b0e9c8ffbca0678547d3b9c424.cloudfront.net (CloudFront)
last-modified
Tue, 21 Jun 2022 15:31:59 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P2
age
52
etag
"57b6f8ad4125903b7e06bb427c232d10"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
public,max-age=1800
accept-ranges
bytes
content-length
10041
x-amz-cf-id
8gcyGQtmfx74uEm8Rc6gpw9b0NXWWJa0uoQ9FCYYzW7FBfT9OZk9xw==
Trust-Logo-Horizontal.svg
www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/
7 KB
2 KB
Image
General
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/Trust-Logo-Horizontal.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 04 Jan 2023 22:31:19 GMT
server
nginx
x-rq
hhn2 85 188 443
etag
W/"63b5fe37-1ab8"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=31536000
banglogo_small.png
www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/
15 KB
15 KB
Image
General
Full URL
https://www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/banglogo_small.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
75e752bf99299219069a5af90f61408be1ab85af71df9aea097bc70e9075c122
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
hhn2 85 187 443
last-modified
Wed, 04 Jan 2023 22:31:20 GMT
server
nginx
etag
"63b5fe38-3b7b"
x-cache
HIT
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
15227
/
www.mercurynews.com/_static/
103 KB
29 KB
Script
General
Full URL
https://www.mercurynews.com/_static/??-eJyVkdFSAyEMRX9INnV0dfrg+C3ski6sgTAk6Gy/XrD2wbF27BNMck9yL8BHNjMnxaSQqS4hCcS0GK8EVgRVwAXRc81EdjLEkIZV7uACOxFzNAcuJteJgngsApnbhPV03gQK2jL7jp5uf8HZs3I6BCJ4x+S4QA6z1oK9dM3ub5DscZNwxB8pQ5qpOpTu5Os5vsWtlZm2zjcNFv0PVHDBprXaspaaNES8cddVuWd+u/hFsZpz7D7LFkHazMOwh6kGckBsHZZGvcaX+6f94zg+j7vd+gm4JMyb
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c541fb7b037e7c9dd5ff3425f3c3431301f9727dd7ae2b59cc882499126c531c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 12 Sep 2023 22:25:00 GMT
server
nginx
x-rq
hhn2 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
p.js
cdn.parsely.com/keys/mercurynews.com/
56 KB
21 KB
Script
General
Full URL
https://cdn.parsely.com/keys/mercurynews.com/p.js?ver=3.9.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.100.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-100-58.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
cdd102d71e33401eb5ebadb19f1732edafa44df8800da6d33f29329c3ed9baef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
public
date
Sat, 16 Sep 2023 05:47:27 GMT
content-encoding
gzip
via
1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
last-modified
Thu, 09 Dec 2021 15:22:33 GMT
server
nginx
x-amz-cf-pop
FRA56-P2
age
49425
etag
W/"61b21f39-df44"
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400, public
x-amz-cf-id
HwdxBBsmncQY3ulcZrkZcDAyuSZKuDZPc4NwuL9xAgDYwB-INeuYbw==
expires
Sun, 17 Sep 2023 04:38:28 GMT
ads.js
www.mercurynews.com/wp-content/themes/wp-mason/static/js/
87 B
132 B
Script
General
Full URL
https://www.mercurynews.com/wp-content/themes/wp-mason/static/js/ads.js?ver=1.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
hhn2 85 187 443
last-modified
Wed, 04 Jan 2023 22:31:20 GMT
server
nginx
etag
"63b5fe38-57"
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
87
/
www.mercurynews.com/_static/
112 KB
30 KB
Script
General
Full URL
https://www.mercurynews.com/_static/??-eJydzk0KwjAQQOELmQ6V1p+FeJY0SdvUzExwpoq3N6ALBRHr9sEHD67ZOCYNpKBjwCBgRYIKiFqNDiYBx4hMlRtnOlUYqZpkBT+4zOnWx5RkCeo4ece2hPSFlYJWmF5g4oFNxMFY1fMnmtM8RBLwPRrrDbKXN17a42Y5ljVdog/8h8ys5foJj3ioN/tmV7fNtp3uHpWYaw==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ba5a6577ef04a324ae8a4af890e1e26d341ac85bc5c49ad9be1678a61fcc3168
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Fri, 15 Sep 2023 22:04:35 GMT
server
nginx
x-rq
hhn2 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
e-202337.js
stats.wp.com/
7 KB
3 KB
Script
General
Full URL
https://stats.wp.com/e-202337.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-minify-cache
hit
x-nc
HIT hhn
date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
br
server
nginx
x-minify
t
etag
W/13576-1684461103136.7104
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Mon, 09 Sep 2024 06:52:50 GMT
sharing.min.js
www.mercurynews.com/wp-content/mu-plugins/jetpack-12.5/_inc/build/sharedaddy/
9 KB
3 KB
Script
General
Full URL
https://www.mercurynews.com/wp-content/mu-plugins/jetpack-12.5/_inc/build/sharedaddy/sharing.min.js?m=1694557500g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 12 Sep 2023 22:25:00 GMT
server
nginx
x-rq
hhn2 85 187 443
etag
W/"6500e53c-2259"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
css
fonts.googleapis.com/
9 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsosTcXsRv6XLOhts09Kk+Ptuq0/CwLdLwkkuvLPBxOpYIYf6JBaYQkrRLKmYXKdA4l0RyEkUUFro1nCCf6k4W9DvuMVDPi/RaKmihngmtJo2rlYJd/676yLx4TG//no5hr1J899RK4ebfMR7fxsu49Bfx/MHV0hlFw==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a2e0d2de51dc225af114789fc0740e5c4e84f03335b755d04bada07003141d8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 16 Sep 2023 18:22:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 16 Sep 2023 16:45:25 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 16 Sep 2023 18:22:12 GMT
be171ec3-329f-4f57-af44-cf5f6bd1f099
https://www.mercurynews.com/
1 KB
0
Other
General
Full URL
blob:https://www.mercurynews.com/be171ec3-329f-4f57-af44-cf5f6bd1f099
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
1245
Content-Type
text/javascript
7245c194-667e-45cd-89b9-0f9911368bab
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/7245c194-667e-45cd-89b9-0f9911368bab
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
ai.0.js
az416426.vo.msecnd.net/scripts/a/
94 KB
22 KB
Script
General
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/4CD6) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
87
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (frc/4CD6)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
afb8d046-d01e-004f-37ca-e8c285000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Sat, 16 Sep 2023 18:52:13 GMT
polyfill.min.js
polyfill.io/v3/
101 B
683 B
Script
General
Full URL
https://polyfill.io/v3/polyfill.min.js?flags=gated&features=es5%2CCustomEvent%2CArray.from%2CArray.isArray%2CArray.prototype.filter%2CArray.prototype.find%2CArray.prototype.findIndex%2CArray.prototype.forEach%2CArray.prototype.indexOf%2CArray.prototype.keys%2CArray.prototype.lastIndexOf%2CArray.prototype.map%2CArray.prototype.reduce%2CDate.prototype.toISOString%2CDocumentFragment%2CDocumentFragment.prototype.append%2CDocumentFragment.prototype.prepend%2CElement%2CElement.prototype.after%2CElement.prototype.append%2CElement.prototype.before%2CElement.prototype.classList%2CElement.prototype.cloneNode%2CElement.prototype.closest%2CElement.prototype.dataset%2CElement.prototype.matches%2CElement.prototype.placeholder%2CElement.prototype.prepend%2CElement.prototype.remove%2CElement.prototype.replaceWith%2CElement.prototype.toggleAttribute%2CEvent%2CJSON%2CMap%2CNumber.parseInt%2CNumber.parseFloat%2CObject.assign%2CObject.create%2CObject.defineProperties%2CObject.defineProperty%2CObject.entries%2CObject.getOwnPropertyDescriptor%2CObject.getOwnPropertyNames%2CObject.is%2CObject.keys%2CObject.values%2CPromise%2CPromise.prototype.finally%2CSet%2CString.prototype.trim%2CXMLHttpRequest%2Cdocument.getElementsByClassName%2Cdocument.currentScript%2Cdocument.querySelector%2Cfetch%2CgetComputedStyle%2ClocalStorage%2CArray.prototype.some%2CDate.now%2CEvent.focusin%2CEventSource%2CFunction.prototype.bind%2CFunction.prototype.name%2CHTMLDocument%2CNodeList.prototype.forEach%2CNodeList.prototype.%40%40iterator%2CNode.prototype.contains%2CObject.getPrototypeOf%2CObject.setPrototypeOf%2CRegExp.prototype.flags%2CString.prototype.%40%40iterator%2CString.prototype.startsWith%2Cconsole%2Cconsole.debug%2Cconsole.error%2Cconsole.info%2Cconsole.log%2Cdocument%2Cdocument.head%2Cdocument.visibilityState%2Clocation.origin%2CrequestIdleCallback%2Cscreen.orientation%2CmatchMedia%2CURL
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:e00::282 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 16 Sep 2023 18:22:14 GMT
age
965939
detected-user-agent
Chrome/117.0.0
useragent_normaliser
chrome/117.0.0
server-timing
HIT-CLUSTER, fastly;desc="Edge time";dur=1
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
113
referrer-policy
origin-when-cross-origin
last-modified
Fri, 25 Aug 2023 12:52:31 GMT
fastly_service_version
227
vary
User-Agent, Accept-Encoding
access-control-allow-methods
GET,HEAD,OPTIONS
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
normalized-user-agent
chrome/117.0.0
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800, immutable
accept-ranges
bytes
timing-allow-origin
*
gen_204
maps.googleapis.com/maps/api/mapsjs/
3 B
250 B
XHR
General
Full URL
https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDJUi9DGZnqI8YbyBueZXiiJjKzw9kGDlE&ver=6.3.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23
x-xss-protection
0
session
session.mercurynews.com/api/
93 B
256 B
XHR
General
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0D0KwzAMBeAL1RaBpD9D6dpr2IkwMpYaKpn2+HWGQDMVmkno8fQNgtfsxocYisFcaiJRYEluokRao4JaMBo3medA4mOVqaDPeoB/jHYg+La9TCuTFeQ2da9V6R4W4PkDUjJ0myUGSSuZvzLP7VFZb3ztjpf+3A39acgf2GmLYg==
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.37.28.33 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-37-28-33.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Sat, 16 Sep 2023 18:22:13 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/
16 B
697 B
Script
General
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json903
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.230.183.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-230-183-11.compute-1.amazonaws.com
Software
- /
Resource Hash
93d1afa10fc671cb2fd0d301fe7a11152fd513a3c26e764364cc3653d7b9a711
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
36
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/
16 B
700 B
Script
General
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json904
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.230.183.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-230-183-11.compute-1.amazonaws.com
Software
- /
Resource Hash
4fdf465af8bd5bf654a1df5aae739993f58fc9435ce0a9b3020bf9b37809cd11
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
36
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
web-vitals.iife.js
unpkg.com/web-vitals@3.4.0/dist/
Redirect Chain
  • https://unpkg.com/web-vitals@3/dist/web-vitals.iife.js
  • https://unpkg.com/web-vitals@3.4.0/dist/web-vitals.iife.js
7 KB
3 KB
Script
General
Full URL
https://unpkg.com/web-vitals@3.4.0/dist/web-vitals.iife.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a85cb4f69ef025b2b86a217f8e999a8f30f43181f15017115e807dd5b021766
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
5875027
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01H50GSMBKB3YNJXSJJ1KZXCRK-fra
server
cloudflare
etag
W/"1b98-Vi0si64rTaloQm7ZXLxPFpdaTq8"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
807b2237a9b30859-FRA

Redirect headers

date
Sat, 16 Sep 2023 18:22:13 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01HAFK4797XEJ8CWZ81R9473A1-fra
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
557
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
location
/web-vitals@3.4.0/dist/web-vitals.iife.js
cache-control
public, s-maxage=600, max-age=60
cf-ray
807b2236b8030859-FRA
563c42fa-49a3-48e2-a51e-a5693698bc5b
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/563c42fa-49a3-48e2-a51e-a5693698bc5b
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
27099d7a-ba7f-4f17-ae4b-28359c6ff8fb
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/27099d7a-ba7f-4f17-ae4b-28359c6ff8fb
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
fonts.gstatic.com/s/droidsans/v18/
22 KB
22 KB
Font
General
Full URL
https://fonts.gstatic.com/s/droidsans/v18/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.3.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 19:52:08 GMT
x-content-type-options
nosniff
age
253805
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
22376
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:25:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Sep 2024 19:52:08 GMT
bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/
88 KB
89 KB
Font
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
17833705
x-jsd-version
1.5.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
90528
x-served-by
cache-fra19135-FRA, cache-jnb7020-JNB
x-jsd-version-type
version
server
cloudflare
etag
W/"161a0-RkmHeGigBozlCxBdDSojXoAQyY8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z3hCQ1EvU7KBZ6B1s8U3x2Buv5cnKHminejIGeXNXakQVzliZUyEd2cBAzQOOit3XWlmkV8oosjxcx3rGrt7apVa5ZMqHjBpXm4Y4cetrDrm%2Byab8bjYL4bhiaegrqqGLUkHazMM5ObwuAcH2%2BQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
cf-ray
807b22370ec69170-FRA
SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
fonts.gstatic.com/s/droidsans/v18/
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/droidsans/v18/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.3.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Fri, 15 Sep 2023 19:45:36 GMT
x-content-type-options
nosniff
age
81397
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21224
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:04:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 14 Sep 2024 19:45:36 GMT
tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
fonts.gstatic.com/s/droidserif/v19/
25 KB
25 KB
Font
General
Full URL
https://fonts.gstatic.com/s/droidserif/v19/tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.3.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa898d9bdc34304905c4b165e561c8dc3fe452b0bdd7259140e1aa530a42136
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Fri, 15 Sep 2023 19:16:17 GMT
x-content-type-options
nosniff
age
83156
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
25980
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:47:46 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 14 Sep 2024 19:16:17 GMT
tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
fonts.gstatic.com/s/droidserif/v19/
22 KB
22 KB
Font
General
Full URL
https://fonts.gstatic.com/s/droidserif/v19/tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.3.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aee4051a20e975b9bb6fdc20984a091eb1f55c35ea87abe441db4cdbe8c116d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 07:44:46 GMT
x-content-type-options
nosniff
age
38247
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
22476
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:19:08 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 15 Sep 2024 07:44:46 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/
47 KB
47 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Thu, 14 Sep 2023 18:16:19 GMT
x-content-type-options
nosniff
age
173154
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48432
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 00:40:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 13 Sep 2024 18:16:19 GMT
b2735541-11be-4db1-b683-88e21b18b33a
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/b2735541-11be-4db1-b683-88e21b18b33a
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
truncated
/
28 KB
28 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
69e30805defbf34fa451a87b0d7c41026d31d627fcb0cc8a2b63a8fd87d08888

Request headers

Referer
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
font/truetype
common.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/
42 KB
10 KB
Script
General
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/common.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cbccc935557398179deeef044a5ab2353e97ca4961f313793c8ba03964c43e93
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Fri, 15 Sep 2023 22:04:35 GMT
server
nginx
x-rq
hhn2 85 187 443
etag
W/"6504d4f3-a619"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
common-async.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/
64 KB
9 KB
Script
General
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/common-async.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
7c51552210cf46e54bf684795ac5ac9b03af17e73f0c96fbf03a798ecb56e49e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Fri, 15 Sep 2023 22:04:35 GMT
server
nginx
x-rq
hhn2 85 188 443
etag
W/"6504d4f3-10029"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
boldcoastal-async.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/
3 KB
1 KB
Script
General
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/boldcoastal-async.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4d04e98fa76e2cdba4b0b45b0b206b13de39ff72f6371b7d97ed515e21646722
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Fri, 15 Sep 2023 22:04:35 GMT
server
nginx
x-rq
hhn2 85 188 443
etag
W/"6504d4f3-c75"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
gtm.js
www.googletagmanager.com/
577 KB
134 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
60322b48dbf3ed19643a4422d1b99c8a47e700df8adb57b412ddabf304006064
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
137142
x-xss-protection
0
last-modified
Sat, 16 Sep 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 16 Sep 2023 18:22:13 GMT
loader.js
cdn.taboola.com/libtrc/medianewsgroup-network/
402 KB
54 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/medianewsgroup-network/loader.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
437d538c1860b956d5d07c4127fe99bac2539cb041259c29f7910d41c778bf06

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
.p1uhTxPHmvGpMTbrPhV3MWpyOXnbVjv
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:13 GMT
x-amz-request-id
QE9481FESHAA0R0B
age
118
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
54357
x-amz-id-2
0s25seVzVuNQBjc7TMCWcZ9+OnKPhJ0a10ihKOcJ4l9CqZrxsPregUmf3f+ExeYVtgrh8E9JC+8=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Thu, 14 Sep 2023 06:21:05 GMT
server
AmazonS3
x-timer
S1694888534.914642,VS0,VE1
etag
"486cdcce16c5f280ad69ed22ab5b4e59"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
48
access-control-allow-origin
*
cache-control
private,max-age=14401
accept-ranges
bytes
x-cache-hits
1
/
cmp.osano.com/ Frame 8FDB
4 KB
1 KB
Document
General
Full URL
https://cmp.osano.com/
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:600:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
64538
content-encoding
br
content-type
text/html
date
Sat, 16 Sep 2023 00:29:19 GMT
etag
W/"287b497c992487af362d33204f87d28f"
last-modified
Thu, 21 Oct 2021 22:01:08 GMT
referrer-policy
strict-origin-when-cross-origin
server
AmazonS3
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding Origin
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
x-amz-cf-id
Rsw7SWDLnXplbdjfLe-ni-MSWblyAh8bl2AeCTSzjWL7-_cMTwL42Q==
x-amz-cf-pop
FRA56-P2
x-amz-version-id
xT1PkIFehetvNf5lINcU02FbT3u47kBr
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-xss-protection
1; mode=block
g.gif
pixel.wp.com/
50 B
93 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=116372247&post=9968021&tz=-7&srv=www.mercurynews.com&hp=vip&j=1%3A12.5&host=www.mercurynews.com&ref=&fcp=1482&rand=0.3466344766107756
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 16 Sep 2023 18:22:13 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
wp-emoji-release.min.js
www.mercurynews.com/wp-includes/js/
18 KB
5 KB
Script
General
Full URL
https://www.mercurynews.com/wp-includes/js/wp-emoji-release.min.js?ver=6.3.1
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 06 Sep 2023 00:21:47 GMT
server
nginx
x-rq
hhn2 85 187 443
etag
W/"64f7c61b-4904"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
truncated
/
3 KB
3 KB
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
14f3a2330f6d02bcd5407635a03c7ab8ed1aa494914c05881137c5e86ae20acf

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
img/png
truncated
/
3 KB
3 KB
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f6d8894bccb6968f9c55a23894a63a454f3425a7a4c19251ba01d9e3493084a0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
img/png
state-ny.png
www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/
10 KB
10 KB
Image
General
Full URL
https://www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/state-ny.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsosTcXsRv6XLOhts09Kk+Ptuq0/CwLdLwkkuvLPBxOpYIYf6JBaYQkrRLKmYXKdA4l0RyEkUUFro1nCCf6k4W9DvuMVDPi/RaKmihngmtJo2rlYJd/676yLx4TG//no5hr1J899RK4ebfMR7fxsu49Bfx/MHV0hlFw==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f9c4ffcfab2c93ba07bd2d4a2dd53a1d23faace457ade18c52c3f4ea67b8ea68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsosTcXsRv6XLOhts09Kk+Ptuq0/CwLdLwkkuvLPBxOpYIYf6JBaYQkrRLKmYXKdA4l0RyEkUUFro1nCCf6k4W9DvuMVDPi/RaKmihngmtJo2rlYJd/676yLx4TG//no5hr1J899RK4ebfMR7fxsu49Bfx/MHV0hlFw==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:13 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
hhn2 85 187 443
last-modified
Wed, 04 Jan 2023 22:31:19 GMT
server
nginx
etag
"63b5fe37-26da"
x-cache
HIT
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
9946
vitals
www.foo.software/api/
0
100 B
Ping
General
Full URL
https://www.foo.software/api/vitals
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
137.184.240.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.25.1 / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Sat, 16 Sep 2023 18:22:14 GMT
server
nginx/1.25.1
x-powered-by
Express
gpt.js
securepubads.g.doubleclick.net/tag/js/
98 KB
29 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
74c2c6465e9aaff9a8052a5f001335f76a558ef3538e2674cbc27a6bb955b699
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29009
x-xss-protection
0
server
cafe
etag
412 / 19616 / 31077885 / config-hash: 14175700841114183422
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Sat, 16 Sep 2023 18:22:14 GMT
apstag.js
c.amazon-adsystem.com/aax2/
249 KB
61 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.110.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-110-17.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
07eb86d32844a4bae782c9a243f8db9a435b9fa116c5b19f7de310789b9d63a8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:01:04 GMT
content-encoding
gzip
via
1.1 36cd2d0f34e25c2dc5099656a60bedac.cloudfront.net (CloudFront), 1.1 91dc0292eef4e22508a3ae73fe64bbf4.cloudfront.net (CloudFront)
last-modified
Thu, 14 Sep 2023 19:03:55 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P1, FRA56-P5
age
1271
etag
W/"c48a6ec54d501e77b70ec98cc7bfa1a9"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=3600
x-amz-cf-id
-dn8xsMX5phKKerZdfj2S6beQsCOQ0RyxfuQipr4gjDzLt6YSsUKlA==
index.js
tags.remixd.com/player/v5/
34 KB
10 KB
Script
General
Full URL
https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-13.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:21:26 GMT
content-encoding
gzip
via
1.1 fce673b0e9c8ffbca0678547d3b9c424.cloudfront.net (CloudFront)
last-modified
Tue, 21 Jun 2022 15:31:59 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P2
age
52
etag
"57b6f8ad4125903b7e06bb427c232d10"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
public,max-age=1800
accept-ranges
bytes
content-length
10041
x-amz-cf-id
yogXHMc28YwIQM9Cd06zQ4ebK7xAs7E8_geO4EjMp7ToBL5uFoyKfg==
impl.20230913-6-RELEASE.js
cdn.taboola.com/libtrc/
809 KB
168 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/impl.20230913-6-RELEASE.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3-br /
Resource Hash
0ebcb226f6a2a75fac2a800ee351cac06b0b9e403f7eeeacd7f046dfc7458af9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
e6uIDgw.sz2e7WLY2.ud6NGdXYQAg3ZM
content-encoding
br
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:14 GMT
x-amz-request-id
H29S83P68N3W1CBX
age
4034
x-amz-server-side-encryption
AES256
x-cache
HIT
content-length
171411
x-amz-id-2
DEpfsGuZB48qoPdIGT+hsn1Dqf+L4Kttw9ZQmNB/UrcV0KCY5qM9L3bxldGFylxWlG01mTIOfFs=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 13 Sep 2023 09:14:33 GMT
server
AmazonS3-br
x-timer
S1694888534.038615,VS0,VE0
etag
"997f98a41a7feca4a291fdef058f4868"
vary
Accept-Encoding
content-type
application/javascript
abp
10
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
13071
style
accounts.google.com/gsi/
533 B
608 B
Stylesheet
General
Full URL
https://accounts.google.com/gsi/style
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-imGtbccZQ7uIW7ajJII8Eg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-imGtbccZQ7uIW7ajJII8Eg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
text/css; charset=utf-8
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Sat, 16 Sep 2023 18:22:14 GMT
status
accounts.google.com/gsi/
40 B
529 B
XHR
General
Full URL
https://accounts.google.com/gsi/status?client_id=682906792919-57292pukl717kpesjb0r4cnr5342j506.apps.googleusercontent.com&as=c5k9qQGH218zq7S3a2ZkHw
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client?ver=6.3.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c76d76b093bc29fc443d18c6816c16aafc66a82cd845316635c618ed8654b726
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-hJbgJ0XBVIS4dIa0Wpnkag' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-security-policy
script-src 'report-sample' 'nonce-hJbgJ0XBVIS4dIa0Wpnkag' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
x-content-type-options
nosniff
content-encoding
gzip
content-disposition
attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
server
ESF
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Mon, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~or...
13619678.fls.doubleclick.net/ Frame 9B21
Redirect Chain
  • https://13619678.fls.doubleclick.net/activityi;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;...
  • https://13619678.fls.doubleclick.net/activityi;dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uam...
651 B
555 B
Document
General
Full URL
https://13619678.fls.doubleclick.net/activityi;dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.38 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f6.1e100.net
Software
cafe /
Resource Hash
aded3c1f5dfa0d8cc79cb7dda63824fdabad2af2fa414da7c094d5913d2d6e76
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
379
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:14 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:14 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://13619678.fls.doubleclick.net/activityi;dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
asyncPixelSync
pixel.sitescout.com/dmp/ Frame C7E4
0
0
Document
General
Full URL
https://pixel.sitescout.com/dmp/asyncPixelSync
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
98.98.134.243 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
ddos.com
Software
A /
Resource Hash

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0,no-cache,no-store
date
Sat, 16 Sep 2023 18:22:13 GMT
expires
Tue, 11 Oct 1977 12:34:56 GMT
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
server
A
config.js
cdn.confiant-integrations.net/3IyQ81Wnn-d6bieQLuWeDuN4PWM/gpt_and_prebid/
160 KB
34 KB
Script
General
Full URL
https://cdn.confiant-integrations.net/3IyQ81Wnn-d6bieQLuWeDuN4PWM/gpt_and_prebid/config.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:90a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0210fdc4c04e23f73485872c046ec10fb91221b5dcae5d9d9c71362ddcc94b7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 16 Sep 2023 16:59:44 GMT
server
cloudflare
x-amz-request-id
3XXWZSGRYDPV2EK0
age
115
etag
W/"8c6921d457e0b8ab85a704a60ad85ec3"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=900, stale-while-revalidate=3600
cf-ray
807b223b8c8d30d6-FRA
alt-svc
h3=":443"; ma=86400
x-amz-id-2
QdG0S/JsrPUzFLRPKCaTGosOOmpfMYB5/sDTwxKPlxkDM2GVFA75GKugWxVh8immAPSibdgb1g8=
launchpad-liveramp.js
launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/
17 KB
3 KB
Script
General
Full URL
https://launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/launchpad-liveramp.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-121.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f35a7a3eb28e1da39e87276b8f75d6203b808e26b63218ffb0be3fd62e0de605

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
0wgTlvozKv_yHsVhsA.bHuhm0r2Cnphv
content-encoding
gzip
via
1.1 6faa38f38a1fee24a829fec7c748876c.cloudfront.net (CloudFront)
date
Sat, 16 Sep 2023 09:50:58 GMT
x-amz-cf-pop
FRA56-P2
age
30677
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-disposition
attachment; filename="launchpad-liveramp.js"
last-modified
Sun, 27 Aug 2023 22:55:22 GMT
server
AmazonS3
etag
W/"e1e9408aa4a994afbbb535269e3387fb"
vary
Accept-Encoding
content-type
text/javascript
x-amz-cf-id
kIUhJ8x4GpYZzFIcSPLZTpmfEYUMP0e7jypoa-byf4UdCcng5dLwwQ==
js
www.googletagmanager.com/gtag/
146 KB
56 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-11039244145
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b3362b0dbba74336a8203d642fdcca76552ebcd5b8ea581054ae46da0a09732f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57411
x-xss-protection
0
last-modified
Sat, 16 Sep 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 16 Sep 2023 18:22:14 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e181730c1a666b38b299b81ead525f7fec078ff980360b4c032e75b9802ebf0d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
7EncTFplbWDUpOxlbB9/Qg==
age
76517
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6836
x-ms-lease-status
unlocked
last-modified
Fri, 15 Sep 2023 10:31:33 GMT
server
cloudflare
etag
0x8DBB5D6EE6672C6
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
3c6836ae-f01e-0049-530d-e87b68000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
807b223b8806380e-FRA
b
sb.scorecardresearch.com/
0
225 B
Image
General
Full URL
https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1694888534259&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-37.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
via
1.1 f952757fdddf3c9caa357164f2d464d8.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
FRA56-P5
x-amz-cf-id
zMXP9IxVnxe309x1zMGWKLuaZiO3YEupQnrvcefWOe5Dsmreewbrdg==
x-cache
Miss from cloudfront
d66dfa6e9938b7de
pixel.sitescout.com/iap/
0
191 B
Image
General
Full URL
https://pixel.sitescout.com/iap/d66dfa6e9938b7de
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
98.98.134.243 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
ddos.com
Software
AC1.1 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:13 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
expires
Tue, 11 Oct 1977 12:34:56 GMT
406006.gif
di.rlcdn.com/
0
98 B
Image
General
Full URL
https://di.rlcdn.com/406006.gif?pdata=partner%3Dtap486987%2Cdata%3Dtype%3Asite%24audience%3AMSO_MercuryNews_ClientSite_Control
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
a80217e1-137d-4acd-b247-057fcd8bf163
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/a80217e1-137d-4acd-b247-057fcd8bf163
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
9f68e5c1-2bd2-4bbd-9528-b22999f64d9e
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/9f68e5c1-2bd2-4bbd-9528-b22999f64d9e
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
c61b4ed0-d68c-4afa-a2c2-5feec003c7b2
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/c61b4ed0-d68c-4afa-a2c2-5feec003c7b2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
5e27ae59-1af2-4fd2-8a51-fab03e715c72
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/5e27ae59-1af2-4fd2-8a51-fab03e715c72
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
bb1ab4fd-c672-4b0b-a568-26228b092049
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/bb1ab4fd-c672-4b0b-a568-26228b092049
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
902
a869.mercurynews.com/DG/DEFAULT/rest/rpc/
112 B
1 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A14%2B02%3A00&ts=1694888534355
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
25e891f4e29e88cd8ac5ab0b7824a2233569d8a1de4048db0abfe914c54ec10b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
124
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
0uDq2ormOJgWOujbU4xj1NxyjhW2F_Ibkgiv2798FLrrWvGU0LMqkA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
902
a869.mercurynews.com/DG/DEFAULT/rest/rpc/
147 KB
23 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A14%2B02%3A00&ts=1694888534357
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
c4814310946174eddc533d431b27ae3dc306fc5413bd87cc1196f34b2111bb03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
22068
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
28yQjRYFomUq7RxhHft82D_Yv9He9QkgUJXPX5s6ueayXOQH-UZkDQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
mercurynews.com
pubcast-files.remixd.com/player-configs/
8 KB
9 KB
Fetch
General
Full URL
https://pubcast-files.remixd.com/player-configs/mercurynews.com
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
f9d24c71e954513157a412b5339112437e013cf99070b258e445101f16747500

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:07:25 GMT
age
889
x-guploader-uploadid
ADPycdv3FcXMtUWmxB8oJ7YigU8TfPArUZt8YEK98NOVlKrNNcHdYmQptzoLgj-CTREK0WceflnqGsFLtoS7fVWAPyHPfY3wMOC9
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8352
last-modified
Thu, 15 Jun 2023 11:20:10 GMT
server
UploadServer
etag
"50de11d656548e115c3b3202413c53f2"
x-goog-generation
1686828010228687
x-goog-hash
crc32c=wwSIAQ==, md5=UN4R1lZUjhFcOzICQTxT8g==
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600
x-goog-meta-cache-control
public, no-cache, must-revalidate
x-goog-stored-content-length
8352
accept-ranges
bytes
content-type
application/json
expires
Sat, 16 Sep 2023 19:07:25 GMT
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309120101/
408 KB
129 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309120101/pubads_impl.js?cb=31077885
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
37b564138a8c782c7ef7f804054712a1bb75a63677dca0e6e186b82102aebb93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 14:41:19 GMT
content-encoding
br
x-content-type-options
nosniff
age
13255
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
131633
x-xss-protection
0
server
cafe
etag
12671944107613252425
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Sun, 15 Sep 2024 14:41:19 GMT
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.110.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-110-17.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding
gzip
via
1.1 1fd323b9134f7d940dac0d007036a604.cloudfront.net (CloudFront)
date
Sat, 16 Sep 2023 06:24:15 GMT
x-amz-cf-pop
FRA56-P5
age
43080
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 29 Aug 2023 08:30:37 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
vary
Accept-Encoding,Origin
x-amz-cf-id
fkNjNfxBV9EmOZfXR_VL0lwdo2qKPReO4s-IYQ62AN1uN9LSt9r0eg==
loader-config.json
loader-cdn.azureedge.net/prod/dfm/
4 KB
2 KB
XHR
General
Full URL
https://loader-cdn.azureedge.net/prod/dfm/loader-config.json?_=1694888533141
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frb/6799) /
Resource Hash
5ce0cb7f558c1aca9c6e94c7d85d76db859218132923c039b7ef7b38a29f8dfd

Request headers

Accept
*/*
Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
content-md5
1iDtMuqZEAqLGRPxG2wEug==
age
41067
x-cache
HIT
content-length
1300
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:44:01 GMT
server
ECAcc (frb/6799)
etag
0x8DB6B18C9F2D8E6
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
e7848ed8-d01e-00a4-566b-e8fe18000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 16 Sep 2023 17:44:21 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
2273
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Sat, 16 Sep 2023 19:44:21 GMT
tag.js
s.btstatic.com/
34 KB
13 KB
Script
General
Full URL
https://s.btstatic.com/tag.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.25.219.214 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-25-219-214.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Date
Sat, 16 Sep 2023 18:22:14 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Aug 2023 21:46:44 GMT
Server
nginx
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Content-Type
application/javascript
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
12525
load.js
pm-widget.taboola.com/medianewsgroup-network/
3 KB
1 KB
Script
General
Full URL
https://pm-widget.taboola.com/medianewsgroup-network/load.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
986ccecb5ddec6d653cdb03022cbb35af07301b752cad8ac1d6c7aa66a11e661

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
iVYX3NWtVvLgaZWbuxTvffzyb1PlHiYS
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:14 GMT
x-amz-request-id
1V7BT0K8G3CW8WS0
age
2484
x-cache
HIT
content-length
1078
x-amz-id-2
aXTys87GMx1ds9E/nRJT9+HK8bE8HC1ItWbnUXHjU2pUKBQclj5wgP/9W5LvRFb3ivtbK8VylM8=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Tue, 30 May 2023 04:23:23 GMT
server
AmazonS3
x-timer
S1694888534.434983,VS0,VE0
etag
"a9928842e0a03e30273550ed905b9329"
vary
Accept-Encoding,
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-cache-hits
5
1c206a7b-4620-4af6-ab1e-788ad8dbaef4.json
cdn.cookielaw.org/consent/1c206a7b-4620-4af6-ab1e-788ad8dbaef4/
3 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/1c206a7b-4620-4af6-ab1e-788ad8dbaef4/1c206a7b-4620-4af6-ab1e-788ad8dbaef4.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20e98b335721c81d56cf4c48dfee8d9ca5be81ac71337db9044fa641781d97c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
46151
content-md5
OjKCeoOqYJKv0lXGtJEnDQ==
content-length
1441
x-ms-lease-status
unlocked
last-modified
Mon, 08 Aug 2022 02:10:37 GMT
server
cloudflare
etag
0x8DA78E32FAABFC3
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
077e4ca9-b01e-010f-63ca-a37345000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
807b223c59669b51-FRA
expires
Sun, 17 Sep 2023 18:22:14 GMT
sync
gum.criteo.com/
46 B
288 B
Script
General
Full URL
https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS&us_privacy=1---&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
275696
expires
60
js
www.googletagmanager.com/gtag/
271 KB
90 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1cff56c8c3ef4ba9d1393f78a10708a8ecf7a68ad29a411edec10b715ef46e12
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
92448
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sat, 16 Sep 2023 18:22:14 GMT
71806d61-2063-4327-8553-35cb6b5bf25c
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/71806d61-2063-4327-8553-35cb6b5bf25c
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
standard-player.html
tags.remixd.com/player/v5/players/
129 KB
30 KB
Fetch
General
Full URL
https://tags.remixd.com/player/v5/players/standard-player.html
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-13.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7f5d73c848836745a93ff7aa540a8f83f9899e3668628f42e9ba0cc6ef5e0b32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:21:41 GMT
content-encoding
gzip
via
1.1 d20f19c14113bb86116d01e6cb4e2844.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P2
age
34
x-cache
Hit from cloudfront
content-length
29730
last-modified
Tue, 21 Jun 2022 15:31:59 GMT
server
AmazonS3
etag
"9a2e807a291cbaccaab15c40f0629813"
access-control-max-age
60
access-control-allow-methods
GET, HEAD
content-type
text/html
access-control-allow-origin
*
cache-control
public,max-age=1800
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges
bytes
x-amz-cf-id
_8DYuQ1gRkQ1ASO8dWFxpwmai8uQUkv1oRA57bC0WSWZMPsmKzSHHA==
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
59 B
304 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
807b223cfc0a4d50-FRA
access-control-allow-headers
Content-Type
3391
config.aps.amazon-adsystem.com/configs/
505 B
771 B
Script
General
Full URL
https://config.aps.amazon-adsystem.com/configs/3391
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-128.fra6.r.cloudfront.net
Software
CloudFront /
Resource Hash
3e585193e120a224a14a3f7638680b4558d7f9623c34731f86cd9cbb953bb1d0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 17:55:11 GMT
via
1.1 a0a81637cc76d6981e4e29044a73b7f6.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
FRA6-C1
age
1623
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=3600
content-length
505
x-amz-cf-id
c3DW01qtnXPKdUFyTyarM4t6U6Pr0EmE1QuDZjzmLqf8AfouYua8zg==
config
c.amazon-adsystem.com/cdn/prod/
337 B
697 B
XHR
General
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=3391&u=https%3A%2F%2Fwww.mercurynews.com
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.110.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-110-17.fra56.r.cloudfront.net
Software
Server /
Resource Hash
f3fd1a56c0d16459bf2d035ad3bf5a65aeb15f387867e4a57d08c0cf3dbb3fa8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 12:30:38 GMT
via
1.1 91dc0292eef4e22508a3ae73fe64bbf4.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA56-P5
age
21096
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
content-length
337
x-amz-cf-id
sBEOHh1i94ytpNq7BtNV-eS-SQZjpMngs2uWugKO39l2GKvWmCypkQ==
bid
aax.amazon-adsystem.com/e/dtb/
64 B
506 B
XHR
General
Full URL
https://aax.amazon-adsystem.com/e/dtb/bid?src=3391&u=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&pid=d92rJOY1CW7Z8&cb=0&ws=1600x1200&v=23.829.1852&t=2000&slots=%5B%7B%22sd%22%3A%22htlad-1-gpt%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-3-gpt%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-6-gpt%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22160x600%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%5D&gpp=DBACOe~~~&gpp_sid=%5B2%5D&gdpre=1&gdprc=CPyMWAAPyMWAAEXb5ADEDFCwAAAAAH_AAAYgAAALzgFAAZAA4ACAAGgAaABCACOAIAAQcBeYAAAA&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.138.185 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-138-185.fra60.r.cloudfront.net
Software
Server /
Resource Hash
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
strict-transport-security
max-age=47474747; includeSubDomains; preload
via
1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA60-P4
x-amz-rid
E483ZRHF06WJ7YC6B633
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
64
x-amz-cf-id
BnPiIR8gGBArJzCYupVtcz_Pfh3v7u4hjckoMRPaSP82FGzESZROEg==
cca9224e-2d42-4cbd-a2bd-545a29e1232a
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/cca9224e-2d42-4cbd-a2bd-545a29e1232a
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
694a9271-9536-4777-b2ed-f92e8207f86e
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/694a9271-9536-4777-b2ed-f92e8207f86e
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
c45ab9ab-3ec5-411c-becc-ae65d635ddac
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/c45ab9ab-3ec5-411c-becc-ae65d635ddac
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3...
adservice.google.com/ddm/fls/i/ Frame CF69
650 B
753 B
Document
General
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Requested by
Host: 13619678.fls.doubleclick.net
URL: https://13619678.fls.doubleclick.net/activityi;dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4886b3c7f8a5307a61109fb5209f6085613f249e174a6e1476fbe685f3e1d0d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://13619678.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
378
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:14 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2c95bbac8e167a1fd9297768d9c45d1f50db54733b750ae889b3a5efd2fae8fa

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
image/svg+xml
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.35.0/
360 KB
85 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.35.0/otBannerSdk.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8132d45eef1f2500760399505fc221a79a3bbe60ed797bbc24599a650e69927
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
bDp57sS049dDkRqCL4m53Q==
age
45228
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
87115
x-ms-lease-status
unlocked
last-modified
Mon, 06 Jun 2022 06:21:06 GMT
server
cloudflare
etag
0x8DA4784BD4AE529
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
8441e95d-601e-00a3-16e1-5a1487000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
807b223dab3d380e-FRA
pmk-20220605.3.js
pm-widget.taboola.com/medianewsgroup-network/
109 KB
30 KB
Script
General
Full URL
https://pm-widget.taboola.com/medianewsgroup-network/pmk-20220605.3.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
463b965e90a6c1e92161047e09f18a7b0c5bfe39c59de875536a744922f18285

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
EpZzlJAx.0y9.uC5nEuXRKLfz.04Efo4
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish
date
Sat, 16 Sep 2023 18:22:14 GMT
x-amz-request-id
DAM11Y8WW0441GFC
age
9467927
x-cache
HIT, HIT, HIT
content-length
30633
x-amz-id-2
R1WtWYmDdmYhnE6C2z0FDpK8g1Uy3NwQv2MAMZmqF1e28TOsr7BJebrxzYXfpeuqVE45bHxiAj4=
x-served-by
cache-bur-kbur8200175-BUR, cache-sjc10073-SJC, cache-fra-eddf8230109-FRA
last-modified
Tue, 30 May 2023 04:23:22 GMT
server
AmazonS3
x-timer
S1694888535.672375,VS0,VE0
etag
"ad88e58bdaa38d8b8e9028ad431a5e02"
vary
Accept-Encoding,,,
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
33, 12696, 13
tag
s.thebrighttag.com/
0
267 B
Script
General
Full URL
https://s.thebrighttag.com/tag?site=t4tmU86&H=-2umnyqz
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.230.31 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-230-31.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:14 GMT
x-bt-requestid
f619c460-54bd-11ee-85ad-0000ac17000c
server
nginx
etag
d41d8cd98f00b204e9800998ecf8427e
content-type
text/javascript
access-control-allow-origin
https://www.mercurynews.com
p3p
CP=NOI DSP COR NID
cache-control
private, must-revalidate
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
fp.min.js
fp-cdn.azureedge.net/prod/dfm/
65 KB
23 KB
XHR
General
Full URL
https://fp-cdn.azureedge.net/prod/dfm/fp.min.js?
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frb/675B) /
Resource Hash
f3988a8a95c5faec9bb5307667596b220a12d277072950244393b5f33091e2fb

Request headers

Accept
*/*
Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
content-md5
VJ6k3v9dRV/0qT39eqFDjw==
age
12390
x-cache
HIT
content-length
23424
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 14:09:43 GMT
server
ECAcc (frb/675B)
etag
0x8DB6B4EABC41F1B
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
a0f50f2d-a01e-004a-6cad-e85431000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
g2i.min.js
g2insights-cdn.azureedge.net/prod/dfm/
220 KB
48 KB
XHR
General
Full URL
https://g2insights-cdn.azureedge.net/prod/dfm/g2i.min.js?
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frb/679A) /
Resource Hash
743fab9929b06e6ea08ee7296b84d0068d27d9fe7552b69f351a3298b968910a

Request headers

Accept
*/*
Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
content-md5
3vlRE270poARifXWcdSFQA==
age
41528
x-cache
HIT
content-length
49062
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:19:27 GMT
server
ECAcc (frb/679A)
etag
0x8DB6B155BA909D6
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
4916455d-401e-001f-0e6a-e844ba000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
t8y9347t.min.js
cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/
879 KB
205 KB
XHR
General
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frb/6745) /
Resource Hash
8fa5f1b25199584dbfacc66a6ff1aa27bacf8ba50e22c210341747e188e3533f

Request headers

Accept
*/*
Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
content-md5
HA5eM+ltC3YjBiAvNHmraw==
age
42370
x-cache
HIT
content-length
209393
x-ms-lease-status
unlocked
last-modified
Mon, 07 Aug 2023 04:39:01 GMT
server
ECAcc (frb/6745)
etag
0x8DB970038FBE7F2
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
8900913f-401e-0030-1468-e84971000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
card-interference-detector.20230913-6-RELEASE.es6.js
cdn.taboola.com/libtrc/
5 KB
2 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/card-interference-detector.20230913-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
326e944f127ab38123a5a84a11393f998ce9b682df316a1c8ce8bba39669051c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
OectK0R05W0paicAFaXNxQMT9oLVqfLe
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:14 GMT
x-amz-request-id
Z0TFRJRJFNSBSPF7
age
259962
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
2181
x-amz-id-2
GHMtYDp83l9rZVRRW53OobO/kHG9X6dD2GIMqFEH8HBFZkgI1TLhZSy1NsviKcrwjcCALnD7beI=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 13 Sep 2023 18:09:33 GMT
server
AmazonS3
x-timer
S1694888535.705052,VS0,VE0
etag
"28fdbc672631ddb19444f8796166e712"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
82
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
124823
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1694888534487&cv=11&fst=1694888534487&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=1332369501.1694888534&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a1666cedb46a95dc2fde18873f9c59fc2e7599f6cef27694a90384b2697b3b4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1438
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
FUtg69tL.js
cdn.jwplayer.com/libraries/ Frame D28E
107 KB
41 KB
Script
General
Full URL
https://cdn.jwplayer.com/libraries/FUtg69tL.js
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:ec00:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
openresty /
Resource Hash
17d6015b753d0261069781fecd45cab46143e8091b6b8a61fa4c09fdef29e640

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:21:20 GMT
content-encoding
gzip
via
1.1 0c371064bf157d89e4b3520c0b29474c.cloudfront.net (CloudFront)
server
openresty
x-amz-cf-pop
FRA60-P4
age
54
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=180
x-robots-tag
noindex, indexifembedded
content-length
41102
x-amz-cf-id
ui6WE3J6qMqJyPeSSujGKwtk_aI9Fm4q0_iUPhHLOT8IxFchZwcTyw==
c226bee1-aa7e-41bd-aa59-2f6da0dc10a7
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/c226bee1-aa7e-41bd-aa59-2f6da0dc10a7
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
wrap.js
cdn.confiant-integrations.net/gptprebidnative/202309120957/
261 KB
83 KB
Script
General
Full URL
https://cdn.confiant-integrations.net/gptprebidnative/202309120957/wrap.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:90a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8ca051f24c9b771310374d1c018407fe47f58a95ab8f9a0aa5251bbb9f6ad32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 12 Sep 2023 14:29:06 GMT
server
cloudflare
x-amz-request-id
TA08NVCGNDJBC238
age
352274
etag
W/"703380e26754c63ed040ba5bdfd636e5"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
cf-ray
807b223e58c430d6-FRA
alt-svc
h3=":443"; ma=86400
x-amz-id-2
4ZNvlEF4k2T9VWpmV5f7mhPZhG6+mbpK/iQi8+yP4mS2PQ4/YwVlESwp4Ismb9Jvz4yIOsUXwbs=
launchpad.bundle.js
launchpad.privacymanager.io/latest/
48 KB
15 KB
Script
General
Full URL
https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-73.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0d9710c2a09a97b82f8ef3234516bbb07e11502b0b8e2ca75afc9aea49006a2d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
uNUH2AHrYo2ZUfT.LbZTjT8KL1vCRxUI
content-encoding
gzip
via
1.1 a75b67932d84d80b40e12159613deb16.cloudfront.net (CloudFront)
date
Sat, 16 Sep 2023 17:55:08 GMT
x-amz-cf-pop
FRA53-C1
age
1627
x-amz-server-side-encryption
AES256
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:eu-west-1:469675294282:build/LaunchPadLibraryBuild-prod:2372f326-bca9-40d0-8140-f6b9a30dca6d
x-cache
Hit from cloudfront
x-amz-meta-codebuild-content-md5
1885e895ec4a8a119242f9de4482a866
last-modified
Thu, 24 Aug 2023 15:44:38 GMT
server
AmazonS3
etag
W/"3145370849b79227e392569b89209345"
vary
Accept-Encoding
content-type
application/x-javascript
x-amz-meta-codebuild-content-sha256
0b0c5f69aae60ef9a0cff5a6b310217c2463820da7e916144e5eab502891f6fe
cache-control
must-revalidate,public,max-age=3600
x-amz-cf-id
oU1159MTMApM02z5IXCStZfVWdoZ8wK8se9SkiXcqtPMwBlUHf4YiA==
t8y9347t.min.css
cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/
389 KB
54 KB
Stylesheet
General
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.css?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frb/67A6) /
Resource Hash
7bb8f25f111a5c210d1c97b500680682cf9b39730b2a332eb5009a7af047ef56

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:14 GMT
content-encoding
gzip
content-md5
l7CfowF+6GbciLFC23l7hQ==
age
1406
x-cache
HIT
content-length
55218
x-ms-lease-status
unlocked
last-modified
Mon, 07 Aug 2023 04:39:01 GMT
server
ECAcc (frb/67A6)
etag
0x8DB970038FA8897
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
27a0be6a-601e-007a-76c7-e8eafe000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
Britain_Royals_03732-1.jpg
www.mercurynews.com/wp-content/uploads/2023/03/
31 KB
31 KB
Image
General
Full URL
https://www.mercurynews.com/wp-content/uploads/2023/03/Britain_Royals_03732-1.jpg?w=862
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d563298c3ede28f01a71384931c619cda9aadce1007034f284f3c0f0316303f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
hhn2 109 84 443
last-modified
Sat, 16 Sep 2023 18:22:15 GMT
server
nginx
etag
"52b9d4dd7fd08390"
vary
Accept
x-cache
MISS
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
content-length
31734
0e47b4c85d84a5101caaf39ed8819a78
a869.mercurynews.com/plugin/plugin/
234 KB
56 KB
Script
General
Full URL
https://a869.mercurynews.com/plugin/plugin/0e47b4c85d84a5101caaf39ed8819a78
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
d1c340e270dec930ebae95bcb524a0c10bcc970da285bd0ff49ccc494a97d3e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Fri, 15 Sep 2023 12:53:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
age
106102
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
56719
x-xss-protection
1; mode=block
last-modified
Thu, 14 Sep 2023 12:53:52 GMT
server
-
etag
0e47b4c85d84a5101caaf39ed8819a78
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
2buVw--CFeeAp1ngSmTEePRdtN-Ml8hXNLS9ElssEUywk-tZwtbD9A==
expires
Sat, 14 Sep 2024 12:53:52 GMT
en.json
cdn.cookielaw.org/consent/1c206a7b-4620-4af6-ab1e-788ad8dbaef4/847ef055-3b35-4b2b-b5b0-6e18235a2a0b/
180 KB
31 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/1c206a7b-4620-4af6-ab1e-788ad8dbaef4/847ef055-3b35-4b2b-b5b0-6e18235a2a0b/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.35.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
749c246fc42cd7cfb7378c500ae5c87405320dc3661acac369453c201ece5a4b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
52119
content-md5
7M1u1h8k+3Zk1/daPxEnHg==
content-length
31879
x-ms-lease-status
unlocked
last-modified
Mon, 08 Aug 2022 02:10:43 GMT
server
cloudflare
etag
0x8DA78E332CE9641
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
13525e13-201e-0145-59ca-a34322000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
807b223fbe729b51-FRA
expires
Sun, 17 Sep 2023 18:22:15 GMT
self
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/
564 B
782 B
XHR
General
Full URL
https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1694888535035
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.75.166 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae6002ac15022650c642b3b75d201bfa0478f2b1cccf1ce75024dd317aff3166

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sat, 16 Sep 2023 18:22:15 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f3OH5KOsiC%2FAmxKejdoe%2FettkbOMOfrDjwoUeYycpeJ%2BEbw2zmRJex7GOH2t6gx9qTbQ0%2BOp%2FL0HDn%2FUHxLA8hGfPb%2F14HJd6gN1S%2BkunB3voAkI0s5Ul7K26dtylFyDFPPb"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=1800
cf-ray
807b224028319c0a-FRA
alt-svc
h3=":443"; ma=86400
ai.0.js
az416426.vo.msecnd.net/scripts/a/
94 KB
22 KB
Script
General
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/4CD6) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
89
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (frc/4CD6)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
afb8d046-d01e-004f-37ca-e8c285000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Sat, 16 Sep 2023 18:52:15 GMT
index.js
cdn.pranmcpkx.com/
7 KB
3 KB
Script
General
Full URL
https://cdn.pranmcpkx.com/index.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frb/67F8) /
Resource Hash
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
content-md5
nynBpfvYghYqzIzsvfssRw==
age
304980
x-cache
HIT
content-length
2382
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jun 2022 17:08:13 GMT
server
ECAcc (frb/67F8)
etag
0x8DA5083F65AD9E0
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
x-ms-request-id
686fdc2e-001e-001e-7a04-e61b66000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
DFM__BANGWPPRODWAB__MERC.json
cdn.czx5eyk0exbhwp43ya.biz/prod/data/dfm/
2 MB
2 MB
Fetch
General
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/data/dfm/DFM__BANGWPPRODWAB__MERC.json?_=1694888535072
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
29806d98a0e2a7cec94df29c4641aa452e1b57c8cc5aec407c7ce95defa46ab4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
AppendBlob
date
Sat, 16 Sep 2023 18:22:14 GMT
last-modified
Tue, 12 Sep 2023 14:47:58 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-committed-block-count
1
etag
0x8DBB39F417722D2
content-type
application/octet-stream
access-control-allow-origin
*
x-ms-request-id
ebc1db63-e01e-0016-6eca-e80169000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
cache-control
no-cache
x-ms-version
2009-09-19
content-length
1803352
ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/
631 B
1 KB
Image
General
Full URL
https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.193.169 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Date
Sat, 16 Sep 2023 18:22:16 GMT
Last-Modified
Tue, 15 Oct 2019 13:44:16 GMT
Server
AmazonS3
x-amz-request-id
HA1G39Z1BDX6YZS8
ETag
"ef2cc7f55b7ab677b023e36033e26471"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
631
x-amz-id-2
8nuwJ0S+LkZQXhlad1zzNYNGzNPv8cCyReZzU/9xjB1xNoWC3XsMzCjqVyEpPbP1DlF34q//piU=
x-amz-meta-s3b-last-modified
20191015T134358Z
1x1-pixel.png
ams-pageview-public.s3.amazonaws.com/
68 B
448 B
Image
General
Full URL
https://ams-pageview-public.s3.amazonaws.com/1x1-pixel.png?id=1a461e4fcca4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.218.137 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Date
Sat, 16 Sep 2023 18:22:16 GMT
Last-Modified
Mon, 26 Oct 2020 16:52:19 GMT
Server
AmazonS3
x-amz-request-id
HA1VR176Q9JS781Z
ETag
"91e42db1c66c0b276abf6234dc50b2eb"
Content-Type
image/png
Cache-Control
no-store
Accept-Ranges
bytes
Content-Length
68
x-amz-id-2
muV/aHAsaHFf6Qkv9M7zUk4GBOCQWdZfnzZSkTEonmDzao65DFVq4DOzElIui8EXkXMA2gfYWqo=
dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3...
13619678.fls.doubleclick.net/ddm/fls/r/ Frame 23E2
Redirect Chain
  • https://adservice.google.de/ddm/fls/i/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;...
  • https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uam...
968 B
427 B
Document
General
Full URL
https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.38 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f6.1e100.net
Software
cafe /
Resource Hash
27fcb96306f3d25af60404672c891032d6e970163584e212c0d0655659cc47e3
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://adservice.google.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
404
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:15 GMT
expires
Sat, 16 Sep 2023 18:22:15 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:15 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
location
https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:16:18 GMT
content-encoding
br
x-content-type-options
nosniff
age
357
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
697
x-xss-protection
0
last-modified
Fri, 30 Jun 2023 18:58:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Sat, 16 Sep 2023 19:16:18 GMT
css2
fonts.googleapis.com/ Frame D28E
3 KB
624 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
933ff38629199ba200d23e1a3afda3ca9cae06352169926a4609942ab4d3742b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 16 Sep 2023 17:50:36 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 16 Sep 2023 18:22:15 GMT
ping.gif
player-files.remixd.com/ Frame D28E
43 B
581 B
Image
General
Full URL
https://player-files.remixd.com/ping.gif?action=playerImpression&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=1&sessionId=491d5c7f-c00c-4211-b590-f5e36c039330&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
x-guploader-uploadid
ADPycdtxEd8CAuMl751QjHg9B_afbEqbpUgYvD_52WSC6iOP-Aii_RIOBiWg83QLho382g3pum28qQG6z6e6mekPWd0zpw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Sun, 15 Sep 2024 18:22:15 GMT
ping.gif
player-files.remixd.com/ Frame D28E
43 B
194 B
Image
General
Full URL
https://player-files.remixd.com/ping.gif?action=loading&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=1&sessionId=491d5c7f-c00c-4211-b590-f5e36c039330&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
x-guploader-uploadid
ADPycdvZBl_RGMo-Mz8v4AWhfiDbp89nfLxkFJO6Hp-Oyzjln_fNpl3XuyGmjIV6nNXJsO9OFrQdTR23Y1NNHwfsOR0D5w
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Sun, 15 Sep 2024 18:22:15 GMT
ping.gif
player-files.remixd.com/ Frame D28E
43 B
192 B
Image
General
Full URL
https://player-files.remixd.com/ping.gif?action=loaded&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=2&sessionId=491d5c7f-c00c-4211-b590-f5e36c039330&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
x-guploader-uploadid
ADPycdvgi3dkHf5ivRitixLVioY1bCQU_CO1c0AoLFkjf9HYkK24wAO7b_un5PyZQOJBfSuBL_zqAHXKCQmJBWHaGMhKHA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Sun, 15 Sep 2024 18:22:15 GMT
c5bdd4cb-0977-4819-be6c-34a92431a2f8
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/c5bdd4cb-0977-4819-be6c-34a92431a2f8
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
/
www.google.com/pagead/1p-user-list/11039244145/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/11039244145/?random=1694888534487&cv=11&fst=1694887200000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2398946719&rmt_tld=0&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:15 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/11039244145/
42 B
455 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/11039244145/?random=1694888534487&cv=11&fst=1694887200000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2398946719&rmt_tld=1&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:15 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
f4fc23c9-c382-4d26-b7fd-dcd050ba272c
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/f4fc23c9-c382-4d26-b7fd-dcd050ba272c
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ Frame D28E
20 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 02:31:16 GMT
x-content-type-options
nosniff
age
316259
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20960
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:18:28 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Sep 2024 02:31:16 GMT
7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v12/ Frame D28E
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs5.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Tue, 12 Sep 2023 17:34:12 GMT
x-content-type-options
nosniff
age
348483
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21144
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:43:23 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 11 Sep 2024 17:34:12 GMT
/
geo.privacymanager.io/ Frame
0
0
Preflight
General
Full URL
https://geo.privacymanager.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-122.fra60.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
*
content-length
0
content-type
application/json
date
Sat, 16 Sep 2023 18:22:15 GMT
via
1.1 a23fc047c59f0902384fa94644607c00.cloudfront.net (CloudFront), 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
x-amz-apigw-id
LXLNsE0yjoEFyAQ=
x-amz-cf-id
zh-kdP9P3vMUpPzAKGrjZ4VfzsXv0UpgQ3mbAk5pTAVSGVZuREMJnQ==
x-amz-cf-pop
FRA56-P3 FRA60-P3
x-amzn-requestid
3b852bd8-e834-41e2-bc91-f5e6569e9897
x-cache
Miss from cloudfront
/
geo.privacymanager.io/
30 B
611 B
Fetch
General
Full URL
https://geo.privacymanager.io/
Requested by
Host: launchpad.privacymanager.io
URL: https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-122.fra60.r.cloudfront.net
Software
/
Resource Hash
55033882e1bc61cac58471a0ce5372606abd57a9663921dbd6f9a4a926c601b0

Request headers

Accept
application/json
Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
application/json

Response headers

date
Sat, 16 Sep 2023 01:29:03 GMT
via
1.1 e45d812d65a0d0336b945e28b9381462.cloudfront.net (CloudFront), 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3, FRA60-P3
age
60792
x-amzn-requestid
a3070476-ce59-484b-9df4-b8af13c0542c
x-amzn-trace-id
Root=1-650504df-29669fd17eebf8df6b3ebe90;Sampled=0;lineage=06620786:0
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type
application/json
access-control-allow-origin
*
x-cache
Hit from cloudfront
x-amz-apigw-id
LU2y6EVXjoEFbxA=
content-length
30
x-amz-cf-id
5QYeZdzVvkFhsE4SgJNKy9xDoepqNZ9AtHOLSn0GsujD6ga1HGBGxw==
access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
up.js
cdn01.basis.net/assets/ Frame 23E2
3 KB
2 KB
Script
General
Full URL
https://cdn01.basis.net/assets/up.js?um=1
Requested by
Host: 13619678.fls.doubleclick.net
URL: https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
41.63.96.2 Frankfurt am Main, Germany, ASN22822 (LLNW, US),
Reverse DNS
https-41-63-96-2.hhn.llnw.net
Software
AC1.1 /
Resource Hash
25b33a7a853f39e447b14be3e6662ccbb0fbce73620bf7778d194cb3fef1d3ab

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://13619678.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
last-modified
Wed, 16 Mar 2022 16:22:21 GMT
server
AC1.1
age
248121
vary
accept-encoding
content-type
application/javascript
accept-ranges
bytes
content-length
1550
x-llid
deb08e6c305bb11b01c4ddb8be0c760d
fe80aef51d8c48fd7563a2238a45d547
a869.mercurynews.com/plugin/library/
348 KB
107 KB
Script
General
Full URL
https://a869.mercurynews.com/plugin/library/fe80aef51d8c48fd7563a2238a45d547
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
1ee5d0e791b0f16b20971f88babafc0040f2d7ae394a6c03efe4c3b7ffe29f03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Fri, 15 Sep 2023 12:53:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
age
106102
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
109384
x-xss-protection
1; mode=block
last-modified
Thu, 14 Sep 2023 12:53:53 GMT
server
-
etag
fe80aef51d8c48fd7563a2238a45d547
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
qwmymVAOLdujZNfO5TIbyUJP2PEWg1gluDU5BHriNHSy6HdPUsUjqg==
expires
Sat, 14 Sep 2024 12:53:53 GMT
LB-Zone-3
a869.mercurynews.com/DG/DEFAULT/rest/rpc/902/
3 KB
2 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902/LB-Zone-3?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A15%2B02%3A00&ts=1694888535322
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
5e809cf73b7be36583f41bf8450c6f3cde0fbd6b868b5d5fc9e1420814ce3ebf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
1182
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
2jPmT5Q9JHmjuQW221XSMdXBFAi5YjiQD50862kEoXQdrdrGapxtlw==
expires
Thu, 01 Jan 1970 00:00:00 GMT
otFloatingFlat.json
cdn.cookielaw.org/scripttemplates/6.35.0/assets/
10 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.35.0/assets/otFloatingFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.35.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b663ab6a199de613fa46b2c524da1bfb8a889234879c5ccdb239602468e5f8e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
+uprNKuR/LB9OxQq0vcYYA==
age
42161
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2690
x-ms-lease-status
unlocked
last-modified
Mon, 06 Jun 2022 06:20:57 GMT
server
cloudflare
etag
0x8DA4784B800072D
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
ba510384-001e-0116-23ca-a35f2d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
807b2241e9c99b51-FRA
otPcCenter.json
cdn.cookielaw.org/scripttemplates/6.35.0/assets/v2/
59 KB
13 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.35.0/assets/v2/otPcCenter.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.35.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b74420758de35d9e305c4be91525ace39bc3961b99841ab0624834b863b7cd01
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
LrLVzrJD9h3ON5w7RMLtUg==
age
52816
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
12974
x-ms-lease-status
unlocked
last-modified
Mon, 06 Jun 2022 06:20:59 GMT
server
cloudflare
etag
0x8DA4784B8F89D0B
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
4170972a-701e-007b-4cca-a3b356000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
807b2241e9ca9b51-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.35.0/assets/
21 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.35.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.35.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74c39b5ec5a61c19ff20d81c0418fabd61d6deb6ac0c967da28761d6b895ff7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
/wtHD+oYY7dZRzCx50GZrQ==
age
47994
x-ms-lease-status
unlocked
last-modified
Mon, 06 Jun 2022 06:21:12 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
3b2ff8c1-901e-0157-19ca-a3773e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
807b2241e9ce9b51-FRA
gtm.js
www.googletagmanager.com/
264 KB
85 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NFD2QGD&l=MG2DL
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7c4280940a27f543999da03f1288b78300fbf0c4f2b92b728a4f67177cd95bd0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
86725
x-xss-protection
0
last-modified
Sat, 16 Sep 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 16 Sep 2023 18:22:15 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1694888535144&cv=11&fst=1694888535144&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=1332369501.1694888534&uamb=0&uaw=0&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4e8e1dd69ccfd9defa4af6df60aa65d5c7616a79e9d1540aeab9ba02f9b92d0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1473
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
poweredBy_ot_logo.svg
cdn.cookielaw.org/logos/static/
3 KB
2 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/poweredBy_ot_logo.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
LpuayL42jB78xRllx0vkOw==
age
1971
x-ms-lease-status
unlocked
last-modified
Fri, 15 Sep 2023 10:31:39 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
7e886b6c-501e-006f-7b1f-e83370000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
807b22428a8b380e-FRA
/
www.google.com/pagead/1p-user-list/11039244145/
42 B
108 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/11039244145/?random=1694888535144&cv=11&fst=1694887200000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&fmt=3&is_vtc=1&random=3311019092&rmt_tld=0&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:15 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/11039244145/
42 B
108 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/11039244145/?random=1694888535144&cv=11&fst=1694887200000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&fmt=3&is_vtc=1&random=3311019092&rmt_tld=1&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:15 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
2aa4887134ba9b4ccaef6ad7eb4c3a40
a869.mercurynews.com/templates/
490 KB
72 KB
Script
General
Full URL
https://a869.mercurynews.com/templates/2aa4887134ba9b4ccaef6ad7eb4c3a40
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
fc73b938f142ca68cea010123bbfcd4820b16c9db828e5b4be9be288d0961b68
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 14:22:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
age
273581
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
73442
x-xss-protection
1; mode=block
last-modified
Tue, 12 Sep 2023 14:22:34 GMT
server
-
etag
2aa4887134ba9b4ccaef6ad7eb4c3a40
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
xusGvfk_4AGt5WYdEtx0VRaGZFwNxEQOFg-xKTAzqEdXR2MO023sbg==
expires
Thu, 12 Sep 2024 14:22:34 GMT
902
a869.mercurynews.com/DG/DEFAULT/rest/rpc/
192 B
1 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=ef1187b5-7391-4165-bddf-8d57d0d35477&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A15%2B02%3A00&ts=1694888535706
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
d754496959e848b85bd3c06db73ac335d58589484a13010a1e0d4cccefaaf5a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
154
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
L56qJB0wb1UIEE5RTmm0sGAqOdkJApuFno6MJy76OGUyNAuczRKOFQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
stats
a869.mercurynews.com/rest/v2/recommendations/
57 B
894 B
Script
General
Full URL
https://a869.mercurynews.com/rest/v2/recommendations/stats?storeId=0595003b-1825-43bc-89bd-9877ca21042f&action=view&itemId=9968021&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&profileId=undefined&isEntrypage=true&hash=bdd5697d1a250d4fcf26d4bab08848cd&lastmodified=1687284760000&referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&&callback=bc_json905
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
79e7bd757fef28db64ff51fd2c2a9a3c0e9e5df3904f9956ae1a97027d169c3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
77
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
text/javascript;charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
x-amz-cf-id
t3gSuudYUJVDjLMWADDyokpvjk2eFzHoUlPunS8wKvthaVlrQiG9Tg==
expires
Thu, 01 Jan 1970 00:00:00 GMT
902
a869.mercurynews.com/DG/DEFAULT/rest/rpc/
565 B
1 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=ef1187b5-7391-4165-bddf-8d57d0d35477&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A15%2B02%3A00&ts=1694888535766
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
6b647dc4230a3e6a9d7e3c9cbd9f99a5a4498174099189428ff9b828a314727b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
182
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
mktbuEd0aiCtoQGl7Ize262p0IcflRnV75jbXXG7JtUNjXt3nv3SLQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
902
a869.mercurynews.com/DG/DEFAULT/rest/rpc/
189 B
1 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=ef1187b5-7391-4165-bddf-8d57d0d35477&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A15%2B02%3A00&ts=1694888535768
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
950ce0924dffa9f9efc60bca449538c0cfdcc4708ab31ecbd3c52d0980552131
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
168
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
d2v6--olS0Vd-GdThvWQEDDF2AeyjikMYFvkImdvgVrnqzy0Gbwt2w==
expires
Thu, 01 Jan 1970 00:00:00 GMT
902
a869.mercurynews.com/DG/DEFAULT/rest/rpc/
189 B
1 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=ef1187b5-7391-4165-bddf-8d57d0d35477&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A15%2B02%3A00&ts=1694888535795
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
e24790d48c25018db898cdff402eba2b270ada160db7bc7464530e20c5ab5f83
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
169
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
Uop-c19K-4A-Jp8ehAVw6mPEFxNOvflHzePLo5ZASkxmoZMhpcTUMg==
expires
Thu, 01 Jan 1970 00:00:00 GMT
902
a869.mercurynews.com/DG/DEFAULT/rest/rpc/
377 B
1 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=ef1187b5-7391-4165-bddf-8d57d0d35477&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A15%2B02%3A00&ts=1694888535797
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
853ee1c67a9ac25bbb69a3c79b6cc94d8dd5c348eaf346a08fce94931dde3687
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
178
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
6DpOX6ECsN7dnRoMWDLp2s16F0X8tvFrnMfCYV8yIshhHMBs7j1rmA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
902
a869.mercurynews.com/DG/DEFAULT/rest/rpc/
6 KB
4 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=ef1187b5-7391-4165-bddf-8d57d0d35477&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A15%2B02%3A00&ts=1694888535798
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
eaadcf5b3b699ca48354c38b1e4b85b9b36fba5cdf93fbd78e0ce18fb838dd97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
2608
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
cF8tsMvZ158eTXktZIONnN2iNBu36bDj0tpWd28RgG77aicDdHjn9g==
expires
Thu, 01 Jan 1970 00:00:00 GMT
vitals
www.foo.software/api/
0
99 B
Ping
General
Full URL
https://www.foo.software/api/vitals
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
137.184.240.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.25.1 / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Sat, 16 Sep 2023 18:22:15 GMT
server
nginx/1.25.1
x-powered-by
Express
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/
66 B
861 B
Script
General
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?bcsessionid=ef1187b5-7391-4165-bddf-8d57d0d35477&&callback=bc_json906
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.230.183.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-230-183-11.compute-1.amazonaws.com
Software
- /
Resource Hash
d818dff57432379290cfdcc9cba750fc3cf36318dc06e3ad3a3e3ccaaf5eaf5b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
86
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
track
dc.services.visualstudio.com/v2/
96 B
281 B
XHR
General
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.236.186.216 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
197028c6f96c74527ef8305b69e8b182c5f04c4a0f48e309a9f980cba6f6470b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
317A1CF7-F5B6-4D21-828C-A19552B575F9
strict-transport-security
max-age=31536000
date
Sat, 16 Sep 2023 18:22:15 GMT
x-content-type-options
nosniff
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length
96
track
dc.services.visualstudio.com/v2/ Frame
0
0
Preflight
General
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.236.186.216 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,sdk-context
Access-Control-Request-Method
POST
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-max-age
3600
content-length
0
date
Sat, 16 Sep 2023 18:22:15 GMT
x-content-type-options
nosniff
902
a869.mercurynews.com/DG/DEFAULT/rest/rpc/
11 KB
4 KB
XHR
General
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/902?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=ef1187b5-7391-4165-bddf-8d57d0d35477&bctempid=&overruleReferrer=&time=2023-09-16T20%3A22%3A15%2B02%3A00&ts=1694888535854
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
b8ae278df4ce0cd32b3a198f6ff6c029aeb7c246adffc7c045c873b68c01bfab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 16 Sep 2023 18:22:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
2685
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
u-gULD_9V7yFtYSyNDlvw5PY1r4-l5fz8-Itr6UY6_dGO0ctxfxHWg==
expires
Thu, 01 Jan 1970 00:00:00 GMT
75ccc336-df4c-4993-b4b5-4f776dc434ad
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/75ccc336-df4c-4993-b4b5-4f776dc434ad
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
recommendations
a869.mercurynews.com/rest/v2/
15 KB
6 KB
Script
General
Full URL
https://a869.mercurynews.com/rest/v2/recommendations?storeId=0595003b-1825-43bc-89bd-9877ca21042f&profileId=undefined&frequencyCap=8&itemId=9968021&request=%5B%7B%22id%22%3A1561661563872%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-09-14T18%3A22%3A15.893Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22SAME_CATEGORY%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%2C%7B%22value%22%3A3%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661593537%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-09-14T18%3A22%3A15.893Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22LOOK_ALIKE%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661645802%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-09-14T18%3A22%3A15.893Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22COLLABORATIVE_FILTERING%22%2C%22rampUp%22%3A%22INSTANT%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A1561661684113%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-09-14T18%3A22%3A15.893Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_CTR%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A%22default%22%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-09-14T18%3A22%3A15.893Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3Anull%7D%5D&&callback=bc_json907
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-118.fra60.r.cloudfront.net
Software
- /
Resource Hash
a236aecfc3ef480b29e1a8be4b153aea8d2c6c53cd1b79044188ea662fb02143
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
4824
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
text/javascript;charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
x-amz-cf-id
dJGIe3ED8zX2FS0Y_Jp37dproSrM7hJeJqxW4WQiwwgha-0dvRS9Vw==
expires
Thu, 01 Jan 1970 00:00:00 GMT
asyncPixelSync
pixel.sitescout.com/dmp/ Frame BE46
0
0
Document
General
Full URL
https://pixel.sitescout.com/dmp/asyncPixelSync
Requested by
Host: 13619678.fls.doubleclick.net
URL: https://13619678.fls.doubleclick.net/ddm/fls/r/dc_pre=CM67l-jfr4EDFTFMwgodL6UB0w;src=13619678;type=retar0;cat=retar0;ord=8967643016937;auiddc=1332369501.1694888534;gtm=45He39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
98.98.134.243 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
ddos.com
Software
A /
Resource Hash

Request headers

Referer
https://13619678.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0,no-cache,no-store
date
Sat, 16 Sep 2023 18:22:15 GMT
expires
Tue, 11 Oct 1977 12:34:56 GMT
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
server
A
4552eb791cd45ddc
pixel.sitescout.com/up/ Frame 23E2
43 B
267 B
Image
General
Full URL
https://pixel.sitescout.com/up/4552eb791cd45ddc?cntr_revenue=&cntr_transactionId=8967643016937&u1=&u2=&u3=&u4=&u5=&src=13619678&cat=retar0&type=retar0&cntr_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
98.98.134.243 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
ddos.com
Software
AC1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://13619678.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:15 GMT
server
AC1.1
content-type
image/gif
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
cache-control
max-age=0,no-cache,no-store
content-length
43
expires
Tue, 11 Oct 1977 12:34:56 GMT
ads
securepubads.g.doubleclick.net/gampad/
120 KB
18 KB
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2858320542504758&correlator=609374838324986&eid=31077941%2C31077885%2C31068366&output=ldjh&gdfp_req=1&vrg=202309120101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1%2Cinterstitial%2Ctop_leaderboard%2Coutstream_video%2Ccube1_rrail_atf&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F5%2C%2F0%2F1%2F2%2F3%2F6%2C%2F0%2F1%2F2%2F3%2F7%2C%2F0%2F1%2F2%2F3%2F8&prev_iu_szs=300x50%7C320x50%2C1x1%2C728x90%7C970x90%7C970x250%2C480x360%2C300x250%7C300x600%7C300x1050%7C160x600&ifi=1&sfv=1-0-40&eri=1&sc=1&abxe=1&dt=1694888537641&lmt=1694881337&adxs=3085%2C1360%2C1636%2C1597%2C2338&adys=79%2C242%2C368%2C2553%2C825&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C0&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vis=1&psz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&msz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&fws=3076%2C1028%2C3076%2C1028%2C3076&ohw=1254%2C1%2C1280%2C711%2C304&ga_vid=845503735.1694888535&ga_sid=1694888538&ga_hid=1003104940&ga_fc=true&dlt=1694888532546&idt=2001&prev_scp=pos%3DSponsorship_1%7Cpos%3Dinterstitial%7Cpos%3Dtop_leaderboard%7Cpos%3DOutstream_Video%7Cpos%3DCube1_RRail_ATF&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D395395726776%26rurl%3D%26articleid%3D9968021&adks=1140109686%2C3360478133%2C142133714%2C824671996%2C2052175676&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309120101/pubads_impl.js?cb=31077885
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
743e9c58c16fe8235da8d0d9c0c026eb0d0d4696cd1e60a394cb80b8689c1907
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:17 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18807
x-xss-protection
0
google-lineitem-id
6257180320,-2,6257180320,6367412333,6159522902
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138430892413,-2,138430892275,138444318070,138413520352
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/
16 KB
12 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202309120101&st=env
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e5d4d4e17edb1ca2bbd89a4369dee79511e43c1355c00db20cd8d8eacf4b55be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:17 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12195
x-xss-protection
0
container.html
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 130D
6 KB
3 KB
Document
General
Full URL
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:17 GMT
expires
Sun, 15 Sep 2024 18:22:17 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sat, 16 Sep 2023 18:22:17 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 433B
13 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
29305
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 10:13:52 GMT
expires
Sun, 15 Sep 2024 10:13:52 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame DEA0
829 B
557 B
Document
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
8c744f10e20a324bfbffb41bab817b514b0006ddb42910d450dea2a6bb933d3a
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-FZvzpf8fMtrgOINIrGptsw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
535
content-security-policy
script-src 'report-sample' 'nonce-FZvzpf8fMtrgOINIrGptsw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:17 GMT
expires
Sat, 16 Sep 2023 18:22:17 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
sodar
pagead2.googlesyndication.com/pagead/ Frame DEA0
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202309120101&jk=2858320542504758&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

D38i8ocviMyns63bFlxz04547CGgVcdJsS8VZS_5djY.js
pagead2.googlesyndication.com/bg/ Frame 433B
37 KB
14 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/D38i8ocviMyns63bFlxz04547CGgVcdJsS8VZS_5djY.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0f7f22f2872f88cca7b3addb165c73d38e78ec21a055c749b12f15652ff97636
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 14:41:20 GMT
content-encoding
br
x-content-type-options
nosniff
age
13257
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14739
x-xss-protection
0
last-modified
Mon, 11 Sep 2023 20:08:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sun, 15 Sep 2024 14:41:20 GMT
generate_204
tpc.googlesyndication.com/ Frame 433B
0
10 B
Image
General
Full URL
https://tpc.googlesyndication.com/generate_204?U_dgpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:17 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
container.html
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame CBD4
6 KB
3 KB
Document
General
Full URL
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:17 GMT
expires
Sun, 15 Sep 2024 18:22:17 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F8E6
6 KB
3 KB
Document
General
Full URL
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:17 GMT
expires
Sun, 15 Sep 2024 18:22:17 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6861
6 KB
3 KB
Document
General
Full URL
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:17 GMT
expires
Sun, 15 Sep 2024 18:22:17 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
view
securepubads.g.doubleclick.net/pcs/ Frame F5E4
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssGBmkrjWWRl6sUgt02hNhrtZXf6UNXvn0JldtsNMqVDjVoD3cqK5lk-KGScUqxElOQfBAYt2PDqSGi8V0D7ZuGLHYfrgLT12Iw6irW3TMKol-9e_5xWuYRrzqlnCa4rwKvExMQZaS9ecHR6s2smNPMkk6t1qnZrvNdblpc3fmwBdqkmbsLULdLtlJDhAVd2LLMctLVtPRhPmXB2Vey8f88heD32lRTE2T3lcUYpXI98bRZbMIsnsCDERK2Y07gQEViAus7t1ke17EcRKizO4R8ItHZBblsGIomvPz_f_wIO-GREiAFZ5wUXsIV8CmPMb8lAnWVpmSkpoxpA3Uio1sbyoNdkaP7Jllm_sGQQHQtRNzKtKbdXfe3xf2dXjqZhP7097fAXVg&sai=AMfl-YRzRHgtS1aZT0GBOhPHGWz_VtphLBO11DspojaNDqlhSzFGjSCbY9FdBh1mL70ZRF9TJ649WniZ_iWP-aP7yq92KrtOi93Rla6Ojw&sig=Cg0ArKJSzB_c_mVsXqweEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
bounce
secure.adnxs.com/ Frame F5E4
Redirect Chain
  • https://secure.adnxs.com/ttj?id=28334192
  • https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D28334192
7 KB
4 KB
Script
General
Full URL
https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D28334192
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
2da7205419537443243ac1dfa7d247dac2dd1ebaab040a4713b796932fba08b9
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:18 GMT
content-encoding
gzip
an-x-request-uuid
7ef049f4-c337-49de-b10c-39b76e8d331c
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary
Accept-Encoding
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
81.95.5.44; 81.95.5.44; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:18 GMT
an-x-request-uuid
cf5267e9-b62a-47dc-9c63-2af765597e72
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D28334192
x-proxy-origin
81.95.5.44; 81.95.5.44; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame F5E4
182 KB
57 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
04d75f9be78718605473f6f76319f2120d63e73e3c789b2b41d78896cbe13f63
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57988
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1694604874705780"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 16 Sep 2023 18:22:18 GMT
moatad.js
js.moatads.com/bangdfp107159576598/ Frame F5E4
0
423 B
Script
General
Full URL
https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.216.77.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-216-77-18.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Date
Sat, 16 Sep 2023 18:22:18 GMT
Last-Modified
Mon, 14 May 2018 18:19:42 GMT
Server
AmazonS3
x-amz-request-id
VP5VJ8N6VTVK41JC
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Content-Type
application/x-javascript
Cache-Control
max-age=11346
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
7IQU0Q/OnhdirwwSBcjtxxt4rDJlFcm6FGKhb6JfUG0Dq4+jARbT1E025qRVoYFcfrMEhGvl2PU=
pixel
protected-by.clarium.io/ Frame F5E4
68 B
244 B
Image
General
Full URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzMxMTE3MjA4NDM6MzAweDI1MA==&v=5&s=v31hafjlbvt&id=eyJkZnAiOnsiYWQiOjUyMzM1MDI2MzYsImMiOjEzODQxMzUyMDM1MiwibCI6NjE1OTUyMjkwMiwibyI6MzExMTcyMDg0MywiQSI6Ii84MDEzL21lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC9jdWJlMV9ycmFpbF9hdGYiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTYtZ3B0In19&cb=8770889&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6TXhNVEUzTWpBNE5ETTZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjozMTExNzIwODQzLCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.118.213 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-118-213.eu-west-1.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

content-type
image/png
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:18 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0
server
nginx/1.18.0 (Ubuntu)
expires
Sat, 26 Jul 1997 05:00:00 GMT
common.js
maps.googleapis.com/maps-api-v3/api/js/54/5/intl/de_ALL/
253 KB
56 KB
Script
General
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/54/5/intl/de_ALL/common.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7b2bde5796819d3b518e597ffeb8298f1d85878a09316615fa34d7f6836a638
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 18:01:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
260462
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
56995
x-xss-protection
0
last-modified
Mon, 11 Sep 2023 21:53:39 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 12 Sep 2024 18:01:16 GMT
util.js
maps.googleapis.com/maps-api-v3/api/js/54/5/intl/de_ALL/
154 KB
49 KB
Script
General
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/54/5/intl/de_ALL/util.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3517f86b0b10a1eaa987e8d95889c50febf5c1ac74ad893f43e689b4716234e3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 18:01:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
260462
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
49726
x-xss-protection
0
last-modified
Mon, 11 Sep 2023 21:53:39 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 12 Sep 2024 18:01:16 GMT
index.js
cdn.pranmcpkx.com/
7 KB
2 KB
Script
General
Full URL
https://cdn.pranmcpkx.com/index.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frb/67F8) /
Resource Hash
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 16 Sep 2023 18:22:18 GMT
content-encoding
gzip
content-md5
nynBpfvYghYqzIzsvfssRw==
age
304983
x-cache
HIT
content-length
2382
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jun 2022 17:08:13 GMT
server
ECAcc (frb/67F8)
etag
0x8DA5083F65AD9E0
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
x-ms-request-id
686fdc2e-001e-001e-7a04-e61b66000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/
631 B
1 KB
Image
General
Full URL
https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.193.169 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Date
Sat, 16 Sep 2023 18:22:19 GMT
Last-Modified
Tue, 15 Oct 2019 13:44:16 GMT
Server
AmazonS3
x-amz-request-id
9PE0CASFCN1W6TWW
ETag
"ef2cc7f55b7ab677b023e36033e26471"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
631
x-amz-id-2
Ky72kk5Wiw4+yAdjeQpSB76pubGhUQPMaoSU/65+o4YnX30dSl4GeocmfnZLqG4MIF51sYq4e3o=
x-amz-meta-s3b-last-modified
20191015T134358Z
ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame CBD4
24 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Thu, 14 Sep 2023 20:57:40 GMT
content-encoding
br
x-content-type-options
nosniff
age
163478
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Fri, 13 Sep 2024 20:57:40 GMT
launcher-1.0.0.js
tj6w5.flx10.com/libs/ Frame CBD4
17 KB
6 KB
Script
General
Full URL
https://tj6w5.flx10.com/libs/launcher-1.0.0.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash
35d3560abefdd86f4994b166ac3ba59f4ebf264b78310a63c7faf4c0e2d1c824

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
content-encoding
gzip
last-modified
Tue, 12 Sep 2023 18:42:41 GMT
server
nginx
etag
W/"6500b121-42ae"
x-hw
1694888538.cds341.fr8.hn,1694888538.cds122.fr8.c
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
content-length
5584
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame CBD4
182 KB
57 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
04d75f9be78718605473f6f76319f2120d63e73e3c789b2b41d78896cbe13f63
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57988
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1694604874705780"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 16 Sep 2023 18:22:18 GMT
moatad.js
js.moatads.com/bangdfp107159576598/ Frame CBD4
0
423 B
Script
General
Full URL
https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.216.77.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-216-77-18.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Date
Sat, 16 Sep 2023 18:22:18 GMT
Last-Modified
Mon, 14 May 2018 18:19:42 GMT
Server
AmazonS3
x-amz-request-id
VP5VJ8N6VTVK41JC
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Content-Type
application/x-javascript
Cache-Control
max-age=11346
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
7IQU0Q/OnhdirwwSBcjtxxt4rDJlFcm6FGKhb6JfUG0Dq4+jARbT1E025qRVoYFcfrMEhGvl2PU=
pixel
protected-by.clarium.io/ Frame CBD4
68 B
243 B
Image
General
Full URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzMxNzYxNDg2ODE6MzIweDUw&v=5&s=v31hafjlcea&id=eyJkZnAiOnsiYWQiOjQ5NDgwOTU1MTcsImMiOjEzODQzMDg5MjQxMywibCI6NjI1NzE4MDMyMCwibyI6MzE3NjE0ODY4MSwiQSI6Ii84MDEzL21lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC9zcG9uc29yc2hpcF8xIiwieSI6MCwiY28iOjAsInMiOiJodGxhZC0xLWdwdCJ9fQ%3D%3D&cb=8805877&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6TXhOell4TkRnMk9ERTZNekl3ZURVdyIsIndkIjp7Im8iOjMxNzYxNDg2ODEsInciOiIzMjAiLCJoIjoiNTAifSwid3IiOjJ9
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.118.213 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-118-213.eu-west-1.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

content-type
image/png
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:18 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0
server
nginx/1.18.0 (Ubuntu)
expires
Sat, 26 Jul 1997 05:00:00 GMT
ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame F8E6
24 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Thu, 14 Sep 2023 20:57:40 GMT
content-encoding
br
x-content-type-options
nosniff
age
163478
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Fri, 13 Sep 2024 20:57:40 GMT
launcher-1.0.0.js
tj6w5.flx10.com/libs/ Frame F8E6
17 KB
6 KB
Script
General
Full URL
https://tj6w5.flx10.com/libs/launcher-1.0.0.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash
35d3560abefdd86f4994b166ac3ba59f4ebf264b78310a63c7faf4c0e2d1c824

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
content-encoding
gzip
last-modified
Tue, 12 Sep 2023 18:42:41 GMT
server
nginx
etag
W/"6500b121-42ae"
x-hw
1694888538.cds341.fr8.hn,1694888538.cds122.fr8.c
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
content-length
5584
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame F8E6
182 KB
57 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
04d75f9be78718605473f6f76319f2120d63e73e3c789b2b41d78896cbe13f63
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57988
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1694604874705780"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 16 Sep 2023 18:22:18 GMT
moatad.js
js.moatads.com/bangdfp107159576598/ Frame F8E6
0
423 B
Script
General
Full URL
https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.216.77.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-216-77-18.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Date
Sat, 16 Sep 2023 18:22:18 GMT
Last-Modified
Mon, 14 May 2018 18:19:42 GMT
Server
AmazonS3
x-amz-request-id
VP5VJ8N6VTVK41JC
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Content-Type
application/x-javascript
Cache-Control
max-age=11346
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
7IQU0Q/OnhdirwwSBcjtxxt4rDJlFcm6FGKhb6JfUG0Dq4+jARbT1E025qRVoYFcfrMEhGvl2PU=
pixel
protected-by.clarium.io/ Frame F8E6
68 B
243 B
Image
General
Full URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzMxNzYxNDg2ODE6NzI4eDkw&v=5&s=v31hafjlcgr&id=eyJkZnAiOnsiYWQiOjQ5NDgwOTU1MTcsImMiOjEzODQzMDg5MjI3NSwibCI6NjI1NzE4MDMyMCwibyI6MzE3NjE0ODY4MSwiQSI6Ii84MDEzL21lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC90b3BfbGVhZGVyYm9hcmQiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTMtZ3B0In19&cb=4454055&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6TXhOell4TkRnMk9ERTZOekk0ZURrdyIsIndkIjp7Im8iOjMxNzYxNDg2ODEsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.118.213 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-118-213.eu-west-1.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

content-type
image/png
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:18 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0
server
nginx/1.18.0 (Ubuntu)
expires
Sat, 26 Jul 1997 05:00:00 GMT
ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 6861
24 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Thu, 14 Sep 2023 20:57:40 GMT
content-encoding
br
x-content-type-options
nosniff
age
163478
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Fri, 13 Sep 2024 20:57:40 GMT
tag
a.teads.tv/page/120244/ Frame 6861
838 B
829 B
Script
General
Full URL
https://a.teads.tv/page/120244/tag
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-51.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8ff7a2435af85471afe50a0b4973b35b4b23f002784fc98082be7f596dcd0af2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, must-revalidate, no-store
access-control-allow-credentials
true
content-length
521
expires
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 6861
182 KB
57 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
04d75f9be78718605473f6f76319f2120d63e73e3c789b2b41d78896cbe13f63
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57988
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1694604874705780"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 16 Sep 2023 18:22:18 GMT
moatad.js
js.moatads.com/bangdfp107159576598/ Frame 6861
0
423 B
Script
General
Full URL
https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.216.77.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-216-77-18.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Date
Sat, 16 Sep 2023 18:22:18 GMT
Last-Modified
Mon, 14 May 2018 18:19:42 GMT
Server
AmazonS3
x-amz-request-id
VP5VJ8N6VTVK41JC
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Content-Type
application/x-javascript
Cache-Control
max-age=11346
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
7IQU0Q/OnhdirwwSBcjtxxt4rDJlFcm6FGKhb6JfUG0Dq4+jARbT1E025qRVoYFcfrMEhGvl2PU=
pixel
protected-by.clarium.io/ Frame 6861
68 B
243 B
Image
General
Full URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzMyNDIyNDU2NDI6NDgweDM2MA==&v=5&s=v31hafjlcjf&id=eyJkZnAiOnsiYWQiOjUzMTUzNTc5MjksImMiOjEzODQ0NDMxODA3MCwibCI6NjM2NzQxMjMzMywibyI6MzI0MjI0NTY0MiwiQSI6Ii84MDEzL21lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC9vdXRzdHJlYW1fdmlkZW8iLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTQtZ3B0In19&cb=9012346&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6TXlOREl5TkRVMk5ESTZORGd3ZURNMk1BPT0iLCJ3ZCI6eyJvIjozMjQyMjQ1NjQyLCJ3IjoiNDgwIiwiaCI6IjM2MCJ9LCJ3ciI6Mn0=
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.118.213 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-118-213.eu-west-1.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

content-type
image/png
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:18 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0
server
nginx/1.18.0 (Ubuntu)
expires
Sat, 26 Jul 1997 05:00:00 GMT
views
prod-dfm-proxy-connext.azurewebsites.net/api/
90 B
1 KB
Fetch
General
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=c98ab204fd52cb53486764d7209082a7&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9

Request headers

source-system
Plugin
site-code
DFM
autoqa
false
accept-language
de-DE,de;q=0.9
settingskey
BANG,MERC
authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NjY4ODg1MzV9.T7suIlMqo5s4ZKTAK0P0_y0XNwLVFzmrjrMeFOyppDU
ssid
0bb4a168e961d00034190e7cddcdd433
environment
prod
config-code
BANGWPPRODWAB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
content-type
application/json
access-control-allow-origin
*
accept
application/json
attr
MERC
location
System
Referer
https://www.mercurynews.com/
version
Version: 2.8.5.1

Response headers

Expires
-1
Pragma
no-cache
Date
Sat, 16 Sep 2023 18:22:18 GMT
Content-Encoding
gzip
X-Server-Time
9/16/2023 6:22:19 PM
Server
Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Content-Length
193
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
views
prod-dfm-proxy-connext.azurewebsites.net/api/ Frame
0
0
Preflight
General
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=c98ab204fd52cb53486764d7209082a7&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin
*
Content-Length
0
Date
Sat, 16 Sep 2023 18:22:18 GMT
X-Powered-By
ASP.NET
sync
gum.criteo.com/ Frame F5E4
51 B
292 B
Script
General
Full URL
https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:17 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
454790
expires
60
ttj
secure.adnxs.com/ Frame F5E4
0
642 B
Script
General
Full URL
https://secure.adnxs.com/ttj?ttjb=1&bdc=1694888538&bdh=5kRKG1wrxtKAkK95ydgwAYbLxqI.&&bdref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F,https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&&id=28334192
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:18 GMT
an-x-request-uuid
1fbc50fe-ace5-445f-9619-e5337ed80151
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
81.95.5.44; 81.95.5.44; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame CBD4
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssxea8kaMMDJqUgsjJTSneF8486Q5R0mHL9qadQee0BXMSjL-TC__2hEYcKWtqOTMzPrWUa3wpvG4DdQaz68QAp6Bq-wxos2PgXNksWqPUoGWDsnuK5X7KCcf44Ho1UO6hLCiWqDmFdi1SFRkqAyRlSPqrpHuWjxJO48p0VOG0_SN_wBYuA5C9WlSpFCVCnNw7t7LSwO_EcTN-35hiDZGLMIUpR1VANCa1mf0gvcuQpsYEmarlC1TJwzIXhxOLBIk8L932anJg8Ac-EzMMRMpURoaZBxIvko3VuFBR_AyM4vm5AG22nHygRH_bVCKr-XRvXoJeraxYTGQMd8D0X9pU0JvwAJhJxyxLI2UpI5UjXg8da8quQGnW5mBAIc3Gb7VC8&sai=AMfl-YThT-LgTNMNdz9bUgcZFi6by_74uQVyUcFRLbG58CxUnHPKP9_fRUI_IQxBTX0Zj5HT0ZlmmL2Ossl70W6TNL8YBn9fSCj_00j9iA&sig=Cg0ArKJSzI-vI5IarJZfEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
view
securepubads.g.doubleclick.net/pcs/ Frame F8E6
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu0YcB7fOl3MZk5Ji1c0P9PpYu3wih5QznR5_A3DOYftjwr_kGrB8KVqoBz16ZodyZgu-roKJSOQGYw-CAjKb2SCU0V9paCRCx5U9KWY11eXmfJL0l8KJ6OrwimTlalnBKyNv1c4pibReDsZfH2mfI5hGYNkaM4CyX3Y1txHRHXiSpgHYQyV25s91SAhKXCv01-PVQPTpwSRWtNDFO7EFt8xCQVPHglFyINCeqgSFD0eD6vcXkvpj5uXs0-FgfZLQnV2TascV02ms_1x0d_YIiGW4Bfn2OCRb7PWeyFk8ISFmS8elpwonEP0Je0sAQfzDi9QnuQYlD0P73JuSkH_FLTmG0YY-LTUYVqdDcyN_Ks6t9TMKVW9PYXWz2uaCYqUnzLGQ0&sai=AMfl-YTC6pTfnK1kL-MpuB_bMS76bkNIdTQHcTrSbh9gYhdU_qUK6bLhzU7EP1JJ9J9VyinFjTLjLCCefCD6K_R09_o4FTr8NRq-VyVOCw&sig=Cg0ArKJSzH24nE1gHT9MEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
sodar
pagead2.googlesyndication.com/pagead/
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202309120101&jk=2858320542504758&bg=!zM-lz4DNAAbP3fMH7907ADQBe5WfOAPh36UGgO1XF9uZ57LUXOKcntkvS8TvQcGFIHhaUknBcBumaKLgozoLeVneEMtKAgAAAPZSAAAACGgBB5kC9l3KjKq9kn6p6XRnOTUJaLBewcBXYDYFTI1msHwsW9V0FL3CuNcTgTfuHmDtmtXEWsCz8Ksv-cnilf3UedHA6Q3THCmXmMyl3wiYBM_YUBQIdrYDDKqD8dKeyWQfshy0IgCP5G3oQ4_UH9nRzlsuj-qfKsPr-lgl_Di5HKN9JCXfuB2Lf7BALf1ftn-mK6PLIjP9qjqkTx8ZqJbCRt4F5LFjz_FgYv5N4vY8HUv-QzBsCOhMQ8xD2MyKJbXL5kcK3KlpYuBJXw6W1EoUGNvKgM5GOFRpx1RR2K9uWBPgYjzRKwSuH7OJLfWjn1FExU6MLrM1087YC1G1cHmeZnYOSm-LIdsY_UWo4IkhZGCOTUn_21jI-p82Sy_6Mo94q3dJE3gjkVPOaTqM3H0njOItOl5WWhemBm99MNewBT3H9JR2eY1qKleW_xCzNsrxS_xa8WjqImzgWQUq4DMOls0q-uFFomP05cjrha_3ariZLCnikEOdFkkTiQaM0uyYQoyNkVC095vgk5cQFWfFFAARWRZ4SeYun2u_kZCCjA4kLbSc1b6FFUhnnu3XH56DLrbpmz94BLx5-VE1bJXEGDFbxZYu5ZWkE66gxGwt_PDsEU1sms1WA96rPo4AQCifIhcmcsdDY8f0GvcEyUeJiVTHi41TZou1Ewk7Ir7JBXQIwyeQzUH5luCm8TJ_1bD18tso3Arflw3SacGATrVMa3OWEQRsYtG4AtBb-0v5goi01a6mUrAzxjGl46EN-PHKRE2tGjhToPokw1zzTLnRY8M1d8ajxBBuU2sA0SikAC4p4_5o3gJQGEeAhNYq70cdx4rRuWqj-cd1YsBwjHUt6k5wItFEt4kZ0UKbi_c33R6ENu1m6mRvGJ9cvzlqeu2m_WHG7HQzPx_IKB0HbtKVsHQcg16kex6EJloIC1BWBHi0jLKlXF8exZ6vwBKQNdwyaFZaOOM8rNENPkBOpH9XuI65Fh20-mdQGSK23atYklLXerDJMIv0bd7H
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

view
securepubads.g.doubleclick.net/pcs/ Frame 6861
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuPe7FkbowJR7syk4vw1_6xldx2ZlB1OpISWix1iZjhtkbzN4SAAvjdURhybG5C6dXRL3_WirCGOPWjMNGIM36IB1e4FwaqOB83iH4SJ4fqLd27mNk1t0xWOCuPGupKmgi0iN1avEAVKFoQ2Ol8Q9BR3sNqgYGPiqFmzHyUyMjeCqw5kUlC6DDcO8TLv6ZfXtPyOJrE8rsidSFUEu02Fn5oIRjAw1Ssz7rC7pKznr5t27QQnXRGJVee77WrFaLYwpl7IUZMjwqexll6gM5IswQCkts_ilP2BbkgfpTc2t7QbFW3QH3ttjkUdOAaE-WK0oaQNrsHebpY6EWkyJORQk1la4gTJ5WVnpyfrGA6EX-f282ITffrp1zRqfju5MGHTp4B-mzNQ5Va&sai=AMfl-YRzS1aWqivYUywDYKFYAwvSd3u_N-id42jSNsQgP2q17wOSg1Zz-XsUCmIuVq1lOv0JDmGHgHPiPlZ9JlX5tz7r9_1slji_d-EQWA&sig=Cg0ArKJSzPCTvN3HmLmMEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:18 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
truncated
/ Frame F5E4
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bfbb54f82cb7b361d04b96a835bc88a7e531382f0c8b7fbd7dc587305dc0d1a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
image/png
ml.br.js
js.matheranalytics.com/static/ltm/ma23578/wp/27/ Frame CBD4
Redirect Chain
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1635
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
150 KB
43 KB
Script
General
Full URL
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Server
107.178.250.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
234.250.178.107.bc.googleusercontent.com
Software
nginx /
Resource Hash
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Fri, 15 Sep 2023 19:09:02 GMT
content-encoding
br
via
1.1 google
last-modified
Mon, 12 Jun 2023 20:29:05 GMT
server
nginx
age
83597
etag
"85aef1250c3704a499337dcfc565d621"
vary
Accept-Encoding
x-cache
HIT Mon, 12 Jun 2023 20:39:11 GMT
content-type
application/x-javascript
cache-control
public,max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44324

Redirect headers

date
Sat, 16 Sep 2023 18:22:19 GMT
via
1.1 google
server
nginx
vary
Accept-Encoding
location
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
cache-control
public, max-age=269200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-served-by
2-gc-europe-west6-8j341011
ml.br.js
js.matheranalytics.com/static/ltm/ma23578/wp/27/ Frame 6861
Redirect Chain
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1635
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
150 KB
43 KB
Script
General
Full URL
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Server
107.178.250.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
234.250.178.107.bc.googleusercontent.com
Software
nginx /
Resource Hash
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Fri, 15 Sep 2023 19:17:07 GMT
content-encoding
br
via
1.1 google
last-modified
Mon, 12 Jun 2023 20:29:05 GMT
server
nginx
age
83112
etag
"85aef1250c3704a499337dcfc565d621"
vary
Accept-Encoding
x-cache
HIT Mon, 12 Jun 2023 20:39:11 GMT
content-type
application/x-javascript
cache-control
public,max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44324

Redirect headers

date
Sat, 16 Sep 2023 18:22:19 GMT
via
1.1 google
server
nginx
vary
Accept-Encoding
location
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
cache-control
public, max-age=269200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-served-by
8-gc-europe-west6-8j341018
ml.br.js
js.matheranalytics.com/static/ltm/ma23578/wp/27/ Frame F8E6
Redirect Chain
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1635
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
150 KB
43 KB
Script
General
Full URL
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
107.178.250.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
234.250.178.107.bc.googleusercontent.com
Software
nginx /
Resource Hash
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Fri, 15 Sep 2023 19:17:07 GMT
content-encoding
br
via
1.1 google
last-modified
Mon, 12 Jun 2023 20:29:05 GMT
server
nginx
age
83112
etag
"85aef1250c3704a499337dcfc565d621"
vary
Accept-Encoding
x-cache
HIT Mon, 12 Jun 2023 20:39:11 GMT
content-type
application/x-javascript
cache-control
public,max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44324

Redirect headers

date
Sat, 16 Sep 2023 18:22:19 GMT
via
1.1 google
server
nginx
vary
Accept-Encoding
location
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
cache-control
public, max-age=269200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-served-by
6-gc-europe-west6-8j341012
truncated
/ Frame CBD4
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5916546f4709fbd69d7e1335e2a10b7587d5144c31aa61bee73bd2f9b68ba29e

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame F5E4
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssUCZD3EDMQoArDaIRSKlAp9BndfKvbjF2UIkNFS4-2zBKyObm0LNPD9hcPBF8Hn320sMwGqNC1bRVA9NscXaIok8Dm-MGMzkczgWROTu28xQ-ohQErHEiFdyrQGR9j6GZLE-bSQh_XFIpmK2B9K_Mrkx0e2yZZbxys8YY1g6jUd0rtLE-e49oRFYFnwsnKkoiCk-Rq4S0PgXkR2gqWlJrv1PCWBapLUd92JKR1QJK0jeXlaKBtMKUgSLdEopUyQoW1SvMQK3yb9dul2eHhXDkMaFbdLS4ogs5mdEheg3nAyJM67QpC-k6e-OR5EeSp_6ZvZcdRmKBWcxSe_2YEwdPWiJ3EKoJGaeFWsSIVNtTJIc20q8xjdDyx6P609iI92ZooVqSho1i8Hg&sai=AMfl-YQLZpup5eTxbHigDZ7UksAYECvOmi2TOQyubxWwF_ekAHuFtOMpAtOGDKNea0NQ7h23OXrHMhXsfTpl1ldZx7qKTa6bNQeglYPqpg&sig=Cg0ArKJSzM2oceDkD43TEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:19 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Sat, 16 Sep 2023 18:22:19 GMT
truncated
/ Frame 6861
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9a9749a3f7347ea1574bde5460000be360ba72224ac5c34848dda53ec85e62d4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
image/png
teads-format.min.js
a.teads.tv/media/format/v3/ Frame 6861
600 KB
131 KB
Script
General
Full URL
https://a.teads.tv/media/format/v3/teads-format.min.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-51.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c6ce25eec9f88c5082f31ab03c9e870e3109e8e14870b0a3be1f28230ecb00ac

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:19 GMT
content-encoding
br
last-modified
Fri, 15 Sep 2023 13:35:52 GMT
x-amz-request-id
3W6QMRNK83DJC9C4
etag
"2a37838623491e8f045660a69c7556ff"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
cache-control
private, must-revalidate, max-age=1800, no-transform
x-bucket
f
accept-ranges
bytes
content-length
134152
x-amz-id-2
PfXBDppVIBR48NDwDCs/RbGs5CgOBmnqz/Mp2rxvrOxUzLvZMTyACApT/yZGyUC91LGkS6/Yd+M=
expires
Sat, 16 Sep 2023 18:52:19 GMT
truncated
/ Frame F8E6
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
03c979666e740eb2c8f37487d38abcd304b6dbae793dfea0e1565b9a2ef46887

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
image/png
wigo-no-slot
sync.teads.tv/ Frame 0411
325 B
477 B
Document
General
Full URL
https://sync.teads.tv/wigo-no-slot
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-16-97-41.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
d85f6474893e823b6eb6ce2ad936235ff13be5d10d1c1dba6517f6dd3a731c59

Request headers

Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-length
325
content-type
text/html; charset=UTF-8
date
Sat, 16 Sep 2023 18:22:19 GMT
expires
Sat, 16 Sep 2023 18:22:19 GMT
pragma
no-cache
server
akka-http/10.2.10
track
t.teads.tv/ Frame 6861
23 B
104 B
Image
General
Full URL
https://t.teads.tv/track?action=placementCall&env=js-sf&auctid=6e33ffb7-03e6-4184-a074-aa9a12c3cd8f&pageId=120244&pid=130377&debug_metadata=eINf1B6Esw&fv=1254&ts=1694888539214&f=1&referer=https%3A%2F%2Fwww.mercurynews.com%2F
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.161.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-161-51.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:19 GMT
cache-control
private, max-age=3666
content-length
23
content-type
image/gif
track
t.teads.tv/ Frame 6861
23 B
134 B
Image
General
Full URL
https://t.teads.tv/track?action=slotAvailable&env=js-sf&auctid=6e33ffb7-03e6-4184-a074-aa9a12c3cd8f&pageId=120244&pid=130377&slot=native&fv=1254&ts=1694888539224&f=1&referer=https%3A%2F%2Fwww.mercurynews.com%2F
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.161.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-161-51.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

expires
Sat, 26 Jul 1997 05:00:00 GMT
date
Sat, 16 Sep 2023 18:22:19 GMT
cache-control
max-age=0, no-cache, no-store
content-length
23
content-type
image/gif
iframe
sync.teads.tv/ Frame 8926
153 B
305 B
Document
General
Full URL
https://sync.teads.tv/iframe?pid=130377&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-sf&auctid=6e33ffb7-03e6-4184-a074-aa9a12c3cd8f&us_privacy=1---&1694888539254
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-16-97-41.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
716a727e47216ad28191f60fb09d59015b1bcb3df8cc32b5bb94f73d534a5732

Request headers

Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-length
153
content-type
text/html; charset=UTF-8
date
Sat, 16 Sep 2023 18:22:19 GMT
expires
Sat, 16 Sep 2023 18:22:19 GMT
pragma
no-cache
server
akka-http/10.2.10
1013667
a.teads.tv/vast/get/ Frame 6861
19 KB
8 KB
XHR
General
Full URL
https://a.teads.tv/vast/get/1013667?pid=130377
Requested by
Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-51.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7e6e3565ba002c2245e78e8f26dc94e65b3354e1158eab503f82d30033a4289d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 16 Sep 2023 18:22:19 GMT
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
access-control-max-age
1728000
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/xml; charset=UTF-8
access-control-allow-origin
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
vary
Accept-Encoding
access-control-allow-credentials
true
cache-control
max-age=0, no-cache, no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Encoding, Accept-Language, Host, Referer, User-Agent
content-length
7467
expires
Sat, 16 Sep 2023 18:22:19 GMT
track
t.teads.tv/ Frame 6861
23 B
134 B
Image
General
Full URL
https://t.teads.tv/track?action=adReceived&env=js-sf&auctid=6e33ffb7-03e6-4184-a074-aa9a12c3cd8f&pageId=120244&pid=130377&slot=native&fv=1254&ts=1694888539263&f=1&referer=https%3A%2F%2Fwww.mercurynews.com%2F
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.161.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-161-51.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

expires
Sat, 26 Jul 1997 05:00:00 GMT
date
Sat, 16 Sep 2023 18:22:19 GMT
cache-control
max-age=0, no-cache, no-store
content-length
23
content-type
image/gif
i
www.i.matheranalytics.com/ Frame 6861
43 B
245 B
Image
General
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjM2NzQxMjMzMyIsImVidXkiOiIzMjQyMjQ1NjQyIiwiZWFkdiI6IjUzMTUzNTc5MjkiLCJlY2lkIjoiMTM4NDQ0MzE4MDcwIiwiZWVudiI6ImoiLCJlcGlkIjoiMjIxMzg1NDYyNDUiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_crossdomain=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=4e0a6f37-e468-45e6-b359-8d3264738917&pid=d8ebf996-174f-4b4f-b177-1e79ddc3b3dd&dtm=1694888539281&qnm=_matherq&visible=1&tabid=3687f155-3f37-449e-b9ce-b305f11ba14f&refr=https%3A%2F%2Fwww.mercurynews.com%2F&url=https%3A%2F%2Fdd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&vrefr=https%3A%2F%2Fwww.mercurynews.com%2F&vp=480x360&ds=480x360&tofa=1694888539&vid=1&lvidt=1694888539&duid=e1f30d55-4e3c-455a-835f-b93a316a9e1e&fp=3826762067&cid=ma23578&mrk=239876506
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.7.177.4 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Sat, 16 Sep 2023 18:22:19 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
i
www.i.matheranalytics.com/ Frame CBD4
43 B
245 B
Image
General
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjI1NzE4MDMyMCIsImVidXkiOiIzMTc2MTQ4NjgxIiwiZWFkdiI6IjQ5NDgwOTU1MTciLCJlY2lkIjoiMTM4NDMwODkyNDEzIiwiZWVudiI6ImoiLCJlcGlkIjoiMjIxMzg1NDYyNDUiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_crossdomain=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=e06debc0-da21-469b-ba4a-de354a23d5d1&pid=57b74853-da70-4f97-b08b-9c9f909f51c8&dtm=1694888539289&qnm=_matherq&visible=1&tabid=3687f155-3f37-449e-b9ce-b305f11ba14f&refr=https%3A%2F%2Fwww.mercurynews.com%2F&url=https%3A%2F%2Fdd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&vrefr=https%3A%2F%2Fwww.mercurynews.com%2F&vp=320x50&ds=320x50&tofa=1694888539&vid=1&lvidt=1694888539&duid=90694d1f-32a1-402e-824e-394c6eb3e171&fp=3826762067&cid=ma23578&mrk=239876506
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.7.177.4 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Sat, 16 Sep 2023 18:22:19 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
i
www.i.matheranalytics.com/ Frame F8E6
43 B
245 B
Image
General
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjI1NzE4MDMyMCIsImVidXkiOiIzMTc2MTQ4NjgxIiwiZWFkdiI6IjQ5NDgwOTU1MTciLCJlY2lkIjoiMTM4NDMwODkyMjc1IiwiZWVudiI6ImoiLCJlcGlkIjoiMjIxMzg1NDYyNDUiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_crossdomain=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=093004d9-3e50-4348-81e0-1a421588440b&pid=27d6cf19-a674-4786-a988-a75247d6a647&dtm=1694888539295&qnm=_matherq&visible=1&tabid=3687f155-3f37-449e-b9ce-b305f11ba14f&refr=https%3A%2F%2Fwww.mercurynews.com%2F&url=https%3A%2F%2Fdd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&vrefr=https%3A%2F%2Fwww.mercurynews.com%2F&vp=728x90&ds=728x90&tofa=1694888539&vid=1&lvidt=1694888539&duid=1b1a012d-8577-42fa-93d9-cf9af2ecaf97&fp=3826762067&cid=ma23578&mrk=239876506
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.7.177.4 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Sat, 16 Sep 2023 18:22:19 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
truncated
/ Frame 6861
669 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
35463ce93e7c820faa404db98d939ff640ae78ca0e29be043861853c9e07c586

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame FA7A
669 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
35463ce93e7c820faa404db98d939ff640ae78ca0e29be043861853c9e07c586

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Type
image/svg+xml
track
t.teads.tv/ Frame 6861
23 B
134 B
Image
General
Full URL
https://t.teads.tv/track?action=adAvailable-success&env=js-sf&auctid=6e33ffb7-03e6-4184-a074-aa9a12c3cd8f&pageId=120244&pid=130377&slot=native&gid=1013667&fv=1254&ts=1694888539359&f=1&referer=https%3A%2F%2Fwww.mercurynews.com%2F
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.161.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-161-51.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

expires
Sat, 26 Jul 1997 05:00:00 GMT
date
Sat, 16 Sep 2023 18:22:19 GMT
cache-control
max-age=0, no-cache, no-store
content-length
23
content-type
image/gif
540_940.mp4
cdn2.teads.tv/scala/1088797/5aa318467dd857d82b49f3ad4fbfa86c/ Frame 6861
1 MB
0
Media
General
Full URL
https://cdn2.teads.tv/scala/1088797/5aa318467dd857d82b49f3ad4fbfa86c/540_940.mp4
Requested by
Host: dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
URL: https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-16-97-41.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Range
bytes=0-

Response headers

date
Sat, 16 Sep 2023 18:22:19 GMT
last-modified
Tue, 01 Aug 2023 16:39:35 GMT
server
AmazonS3
x-amz-request-id
ERYC3W1XCKTDZRF5
etag
"f12212f13affb0df11f85491f7f246ac"
x-amz-server-side-encryption
AES256
content-type
video/mp4
access-control-allow-origin
*
Content-Range
bytes 0-2729915/2729916
cache-control
private, max-age=31536000
accept-ranges
bytes
Content-Length
2729916
x-amz-id-2
nOCgeJ6xmcSBCU4r9dCJp+KY9lQLuORK0dllZpLcosEENsZUqdplG+VO7cSYI2k7VFsPHQ6toh4=
expires
Sun, 15 Sep 2024 18:22:19 GMT
event-stream
k.p-n.io/
0
126 B
Fetch
General
Full URL
https://k.p-n.io/event-stream
Requested by
Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.3.1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.192.162.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-192-162-218.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Sat, 16 Sep 2023 18:22:19 GMT
access-control-allow-headers
*
access-control-max-age
600
access-control-allow-methods
*
event-stream
k.p-n.io/
0
125 B
Fetch
General
Full URL
https://k.p-n.io/event-stream
Requested by
Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.3.1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.192.162.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-192-162-218.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Sat, 16 Sep 2023 18:22:19 GMT
access-control-allow-headers
*
access-control-max-age
600
access-control-allow-methods
*
json
trc.taboola.com/medianewsgroup-mercurynews/trc/3/
109 KB
30 KB
XHR
General
Full URL
https://trc.taboola.com/medianewsgroup-mercurynews/trc/3/json?tim=20%3A22%3A19.509&lti=deflated&data=%7B%22id%22%3A941%2C%22ii%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1694672463670%2C%22vi%22%3A1694888539506%2C%22cv%22%3A%2220230913-6-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22bv%22%3A%220%22%2C%22wc%22%3Atrue%2C%22ul%22%3A%5B%22en-US%22%2C%22en%22%5D%2C%22uad%22%3A%7B%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D%2C%22cmps%22%3A1%2C%22ga%22%3Atrue%2C%22ccpa_ps%22%3A%221---%22%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bu%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22vpi%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A4000%2C%22dh%22%3A6991%2C%22nsid%22%3A%22medianewsgroup-network%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A6%2C%22uim%22%3A%22thumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22cd%22%3A4993.953125%2C%22mw%22%3A954.875%7D%5D%2C%22cacheKey%22%3A%22text%3D%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2CBelow%20Article%20Thumbnails%3Dthumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D&llvl=2
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3e84c37934c40a6f03d4f161855191caa5f1922eac755fef48f36b87c78b720c

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
text/plain

Response headers

x-vcl-time-ms
737
date
Sat, 16 Sep 2023 18:22:20 GMT
content-encoding
gzip
via
1.1 varnish
cpu
1.0610416666666667
x-fastly-to-nlb-rtt
7595
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v1
x-served-by
cache-fra-eddf8230109-FRA
x-log-content-encoding
gzip
server
nginx
x-timer
S1694888540.524132,VS0,VE737
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
debug
trc-events.taboola.com/medianewsgroup-mercurynews/log/2/
0
90 B
Image
General
Full URL
https://trc-events.taboola.com/medianewsgroup-mercurynews/log/2/debug?tim=20%3A22%3A19.503&type=warn&msg=Error%20while%20calling%20__tcfapi%3AgetTCData(TypeError%3A%20window.__tcfapi%20is%20not%20a%20function)&llvl=2&id=3875&cv=20230913-6-RELEASE&lt=deflated&pct=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:19 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
16872
delete
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/ Frame
0
0
Preflight
General
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=c98ab204fd52cb53486764d7209082a7&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin
*
Content-Length
0
Date
Sat, 16 Sep 2023 18:22:19 GMT
X-Powered-By
ASP.NET
delete
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/
0
805 B
Fetch
General
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=c98ab204fd52cb53486764d7209082a7&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

source-system
Plugin
site-code
DFM
autoqa
false
accept-language
de-DE,de;q=0.9
settingskey
BANG,MERC
authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NjY4ODg1MzV9.T7suIlMqo5s4ZKTAK0P0_y0XNwLVFzmrjrMeFOyppDU
ssid
0bb4a168e961d00034190e7cddcdd433
environment
prod
config-code
BANGWPPRODWAB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
content-type
application/json
access-control-allow-origin
*
accept
application/json
attr
MERC
location
System
Referer
https://www.mercurynews.com/
version
Version: 2.8.5.1

Response headers

Expires
-1
Pragma
no-cache
Date
Sat, 16 Sep 2023 18:22:20 GMT
X-Server-Time
9/16/2023 6:22:20 PM
Server
Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Content-Length
0
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
/
tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/320x50/ Frame AA29
66 KB
19 KB
Document
General
Full URL
https://tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/320x50/?cacheBuster=1984593769&destUrl=https%3A%2F%2Fwww.bestinsv.com%2F%3Futm_source%3Dbang%26utm_medium%3Dbanner&clickTracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvkiQ7D7KFxM4264W1Cyahqox5onN5PFF9o4rrm_gc7w_CK3KYRcDyrdUDHPbn3mh4hBVNAAmuYnDdxLy7BShhDAsN4K0_tu0bRthhSq5Bqi4wjrarZlZw03pdp2D-axevZIUSoSQBcIMx6J7qydOJRH5RzRRGx1_GVGF4mfa0AxCHeMx-7ZPkKcYpEDnquILrjU8uYbno83LBP-eOnIjftAVRZrzEHSYKQxIuUlVDAIiV8zIY8OGQv1bLTwvY9TOmabeffsI9717i884nKTrUxJypG3zi6mFqlBMRWaw_J2y7KNA96mOWkjS7W-3z4gHdGkiSG_K0DoLGR1pEkkiVRRfXS8X7ulhmvoHUU-CzNcSDw2_o7Tk8Pb4ywbkDv%26sai%3DAMfl-YRELPywSbkwYLDBBDrkZ3DQmPxiVMZdr-NJLNhNpKz2AmoqZpBzyQOy-zrBLStY-o5I908TyjZqM2cX0Q57PQ-2dx9n69vfQmC8-g%26sig%3DCg0ArKJSzHlXSFUPLDV4EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash
7b7432ac842f8423f422e24e0782071576596df5c2eaf2d4e92c0dc0b846ecf8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
access-control-allow-origin
*
cache-control
no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-length
18595
content-type
text/html
date
Sat, 16 Sep 2023 18:22:20 GMT
server
nginx
strict-transport-security
max-age=15552000; includeSubDomains
x-hw
1694888540.cds341.fr8.hn,1694888540.cds290.fr8.c
view
securepubads.g.doubleclick.net/pcs/ Frame CBD4
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstV8TFiUPWnljX4VG_gfp_LB78AiBLy6rWH5RVpG6kKkY43BU0DYdhN9KkRWdS2qyXXwyGnBsjf_Uzhx9PQXZEWUvtojWcJxSu5VVaTm85uh45nehkUuPCtbynouXmgBhFjl7-7tb9nfBw61fxxctE2SLSinGlBmHVGzkwDWdgeUIKvCDuXLkep9VBeknPs7MX8K8uaP_16kKXVfVi70vFVrBNHNpelUDYbsIXaXyreQvcp70eJ4KdutWeqqZYETdw28deBsml0zPjBFi-VOS_QOpAw_E8F1QfOyHccA3Be50LqHBVrYMlOsa6aAe6vy5uh24xjFEnMFXr4ZyLVFSMxuGqeS7Kro6T9hJkbFrmESyVtaqkc2qkYbOSfYxu1eci1CDo&sai=AMfl-YT-MiepWDW_MlSVe3KCrWrzshSA5qVLSDi55CA1Q3AcJJVhUB7y9eHyVHo9ytv8cxTrXAmOZR5exjjdxiMxxBt5h6CMKzF8V2176g&sig=Cg0ArKJSzC_nTGorMbU_EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:20 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Sat, 16 Sep 2023 18:22:20 GMT
/
tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/728x90/ Frame 3702
74 KB
19 KB
Document
General
Full URL
https://tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/728x90/?cacheBuster=15259304&destUrl=https%3A%2F%2Fwww.bestinsv.com%2F%3Futm_source%3Dbang%26utm_medium%3Dbanner&clickTracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstvqDF631KgJowHOx64xtxkaTMIlZz-YrB-YgqIcv0iMw-qu_Lc6Qex_t2idlV2DasQwk1uRGGWIhEg66_-q0woZcgiHRjGyZsgAxu2UD37YzmUdVXfS48eGeG860ducc7decPlB-Lq3xRzHO2xchzyw4s6kjpX7P6mMqup8b2xcW72Z2w_5k3QkXv1qbmb42keqom8Gsmb-EzdrRvO94kTe8cNHrtDu9jT0XEVQTP7yfpzoz24GJi23hOBIdX9ySCsQfl6SsvlvKBA2bBXfdj8D4lS2KKB2-wT5LEzqCxyO1tgWjfOoJzsJGDpiXGavuSOUO6jxbDIens7DKl8JhKYKWlUUngZCpPeUa-Lo5IWZpp4zNI-QtcRg57REgHaILo%26sai%3DAMfl-YTGOz2iUN4lIZsSU0FWZnrqtDFlXALtA77XmD9TvvEsut78UD3JMTSyiqXmW7Qcuqr6NXn_DZAvTC2im78SVXUJ0t5DBmMydjYqgQ%26sig%3DCg0ArKJSzPbuen0I_JexEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash
406f39e8d43621372cc26980295d23da7487978b4de6175246a70858ff3d0b46
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
access-control-allow-origin
*
cache-control
no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-length
19359
content-type
text/html
date
Sat, 16 Sep 2023 18:22:20 GMT
server
nginx
strict-transport-security
max-age=15552000; includeSubDomains
x-hw
1694888540.cds341.fr8.hn,1694888540.cds338.fr8.c
view
securepubads.g.doubleclick.net/pcs/ Frame F8E6
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu4HbCtH5Zu1XPuTk5GOoVNTBuSz315nWdcBD7UV7EQafvCm602RNVuarIcjDkNLycTM9sOdWvZEXCkcQ35dbDr86ehLk5lsyfFDP_bSGbuZIQHxxy8tVroKo1qfaVXWhzLc9mXVqFlBNJjlUb4Wfz2pMk6R-fbrwH7TgajF8ywY5i5OukWxBWZFCrHyC7RwuC8eUtt0LTmKpsXHXamnn4n1efM7ew6UXCpHJG72ZNjclb-E-BFbecGDDn4H5L_Q6U-Ugg5Y0trbRMbR7MgfUuG-dIoJItOsiqdC4k6unNj4eGyJy5JlVT2cJwrUUtgZ1orwmsOcP8pOApjZlbjyCch-_KDL8JVpZRO-8D8658WKHQL98htVO2bL01q2FLgBNoo-tbR5g&sai=AMfl-YQSVAHlZBtZCPK0Lxz4t9usaJvwioAZdMAN0orj8P-03AxaGXiZLeIK3i8jr9OHJR0cA0VRX_Kb9xbS3GkDuNXwVtLIvNLLh8ejzg&sig=Cg0ArKJSzPUrNEhbwz3hEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:20 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Sat, 16 Sep 2023 18:22:20 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 6861
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstdGDbUVO1UH8qwOVrPZKOs_jhmAOr9Po8xqUaP1id12w2c1SSRvCwiHezFuOH5FznWb8ozYHnCbHPW0Ug9gxHUAn-FLPpeOwEhj1hSx17EZtrwNEPpOQJb9yH9weHWoRQuYSEz2RQFJ43CDjaiLWz1mQuPKBvXlyDwTb7H1FsPvIkfsFzNpKo916jrzzcmX7Pgld2RRsz40-sSlMC8XPuTyWc72OuRM_Npg7nQj3BeK6OjrwuggqnOP9eRFowOhOFMUIit8-zYB98_e4CiX9Ye63YTBiCjQtxiRXxBhjFccuaClgezHK2KlN0lnadaiVmF_DlOKFPW2XGTJt0CSF1y_0_LU4CJh0z1cGSMtbebnuapcJr2CdYl3ImpnDCwZSpRt7LSxogYzgA&sai=AMfl-YS89svqhdOlOZ2zrSWxMez2LZ7yydVaQUxXYAsFKo2BRfos-wRrXVsnn8XYs2oeb80Wo5VXjfqNYTFgd8jp04KWVVdAk0KL8ZqCQQ&sig=Cg0ArKJSzCcWJi1yR7MaEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:20 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Sat, 16 Sep 2023 18:22:20 GMT
UnitFeedManagerDesktop.min.js
vidstat.taboola.com/lite-unit/4.3.0/
127 KB
36 KB
Script
General
Full URL
https://vidstat.taboola.com/lite-unit/4.3.0/UnitFeedManagerDesktop.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c44e080ef80f83f7fc346253431046ff2bfe10ff0762acc1c247be5e169547ea

Request headers

Referer
https://www.mercurynews.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 a300dbfb49a2eb50edb83038642c9f82.cloudfront.net (CloudFront), 1.1 varnish
content-encoding
gzip
x-amz-cf-pop
FRA60-P1
age
897464
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT
content-length
36498
x-served-by
cache-fra-etou8220105-FRA
last-modified
Wed, 06 Sep 2023 09:01:32 GMT
server
AmazonS3
x-timer
S1694888541.787242,VS0,VE0
etag
"1865860838c0a4f202ab61510882ea01"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
access-control-allow-headers
*
x-amz-cf-id
MBwNQWWoasK9QdVBzfrJSMb4dGtXeyY63MWPfWLulxwQ0SOIpiRafA==
x-cache-hits
101201
f89e1763-220d-4e09-ba69-9e040548fb7a.svg
cdn.taboola.com/static/f8/
4 KB
2 KB
Image
General
Full URL
https://cdn.taboola.com/static/f8/f89e1763-220d-4e09-ba69-9e040548fb7a.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
39b076e4bb4fab9b8a142499cf6155f8c128464974691a04de7e764f71b72618

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
cMrDKn.emLmm9kiiOOF64ulDT4DRy6LK
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:20 GMT
x-amz-request-id
CCG7A4WVWN5WJAVZ
age
65
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
1758
x-amz-id-2
TBmCggLO8/GElgFPb5rvRR7gHff4xRNz3fdHVeMViDUfwUB4CbODSlFFpnwJ77ZBlNCMfCXQR04=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 07 Feb 2018 11:15:52 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1694888540.315459,VS0,VE0
etag
"b8b410e4b18d45aa2f3d9bc09cd335fb"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
abp
98
cache-control
private,max-age=31536000
accept-ranges
bytes
access-control-allow-headers
*
x-cache-hits
91
ai.aspx
m.exactag.com/
43 B
1 KB
Image
General
Full URL
https://m.exactag.com/ai.aspx?tc=9bf5f8078f74b8e1e0ce123c65ef9546
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.202.235.9 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Date
Sat, 16 Sep 2023 18:22:19 GMT
X-Content-Type-Options
nosniff
P3P
policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy
cross-origin
Connection
close
X-ET-Monitoring
1
Content-Length
43
X-Xss-Protection
0
Pragma
no-cache
Last-Modified
Sa, 16 Sep 2023 06:22:20 GMT
X-ET-Code
0
Accept-CH
sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age
1000
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
private
Access-Control-Allow-Credentials
true
X-ET-Camp
1192
Access-Control-Allow-Headers
*
Expires
Mon, 26 Jul 1997 05:00:00 GMT
abtests
am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/
0
230 B
Image
General
Full URL
https://am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=AM:AM:V&tvi48=10637&tvi50=10582&lti=deflated&ri=0857e9c2ac9fbd85a55321eb3013413d&sd=v2_b364651dfa3ac9e9d9b1be50c74a7db7_278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db_1694888539_1694888539_CNawjgYQtdRXGPLq6vmpMSABKAEwODib4wlAgooQSL--2QNQ____________AVgAYABo2ZPr9_We9LvCAXAA&ui=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1694888539506&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22block_clicks_init%22%2C%22type%22%3A%22block-clicks-manager%22%2C%22eventTime%22%3A1694888540298%7D&tim=20%3A22%3A20.298&id=1391&llvl=2&cv=20230913-6-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:20 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
ai.aspx
m.exactag.com/
60 B
60 B
Image
General
Full URL
https://m.exactag.com/ai.aspx?tc=694de47960dfccdda3fe7bd85c12bd25
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.202.235.9 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Date
Sat, 16 Sep 2023 18:22:20 GMT
Strict-Transport-Security
max-age=31536000
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
P3P
policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy
cross-origin
Connection
close
X-ET-Monitoring
1
X-Xss-Protection
0
Pragma
no-cache
Last-Modified
Sa, 16 Sep 2023 06:22:20 GMT
X-ET-Code
0
Content-Type
image/gif
Cache-Control
max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-ET-Camp
1192
Expires
Mon, 26 Jul 1997 05:00:00 GMT
supply-feature
am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/
0
230 B
Image
General
Full URL
https://am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/supply-feature?route=AM:AM:V&tvi48=10637&tvi50=10582&lti=deflated&ri=0857e9c2ac9fbd85a55321eb3013413d&sd=v2_b364651dfa3ac9e9d9b1be50c74a7db7_278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db_1694888539_1694888539_CNawjgYQtdRXGPLq6vmpMSABKAEwODib4wlAgooQSL--2QNQ____________AVgAYABo2ZPr9_We9LvCAXAA&ui=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1694888539506&d=%7B%22event_type%22%3A%22EXPLORE_MORE%22%2C%22event_state%22%3A%22ADOPTED%22%2C%22event_value%22%3A%22%22%2C%22event_msg%22%3A%22%22%2C%22event_key%22%3A%22%22%7D&tim=20%3A22%3A20.368&id=9900&llvl=2&cv=20230913-6-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:20 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
social
am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/
0
230 B
Image
General
Full URL
https://am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/social?route=AM:AM:V&tvi48=10637&tvi50=10582&lti=deflated&ri=0857e9c2ac9fbd85a55321eb3013413d&sd=v2_b364651dfa3ac9e9d9b1be50c74a7db7_278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db_1694888539_1694888539_CNawjgYQtdRXGPLq6vmpMSABKAEwODib4wlAgooQSL--2QNQ____________AVgAYABo2ZPr9_We9LvCAXAA&ui=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1694888539506&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%E2%80%99%20ex-Spotify%20exec%20tells%20BBC%22%2C%22sec%22%3A%22Entertainment%22%2C%22aut%22%3A%5B%22Martha%20Ross%22%5D%2C%22img%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1.jpg%3Fw%3D1024%22%2C%22v%22%3A15%2C%22pw%22%3Afalse%7D%5D%7D&tim=20%3A22%3A20.798&id=8035&llvl=2&cv=20230913-6-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:20 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
abtests
am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/
0
230 B
Image
General
Full URL
https://am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=AM:AM:V&tvi48=10637&tvi50=10582&lti=deflated&ri=0857e9c2ac9fbd85a55321eb3013413d&sd=v2_b364651dfa3ac9e9d9b1be50c74a7db7_278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db_1694888539_1694888539_CNawjgYQtdRXGPLq6vmpMSABKAEwODib4wlAgooQSL--2QNQ____________AVgAYABo2ZPr9_We9LvCAXAA&ui=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1694888539506&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22recommendation-reel%22%2C%22type%22%3A%22available%22%2C%22eventTime%22%3A1694888540820%7D&tim=20%3A22%3A20.821&id=8052&llvl=2&cv=20230913-6-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:20 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
a32b15b645f4107e169ceaa04b9011e5.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
23 KB
24 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a32b15b645f4107e169ceaa04b9011e5.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
75b9f7cb9145ab6ba7dab006ea44900ba52c69191d2fc9dfc14c534980c07965

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a32b15b645f4107e169ceaa04b9011e5.jpg
age
5138511
edge-cache-tag
313702969523318988065151788664381738762,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
313702969523318988065151788664381738762,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
475
req-referer
https://games.espn.com/
content-length
23526
x-request-id
41768da8a0210e262177e7606a58b08a
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb802
x-served-by
cache-iad-kjyo7100164-IAD, cache-iad-kcgs7200121-IAD, cache-chi-kigq8000046-CHI, cache-iad-kjyo7100081-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 14 Jul 2023 17:19:18 GMT
server
nginx
x-timer
S1694888541.840076,VS0,VE1
etag
"22c554afb3ca75d825f3d90ffcf42408"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 46, 1
f768ee4833f57820eb597a8d7bba4e81.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
14 KB
15 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f768ee4833f57820eb597a8d7bba4e81.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
63f681f0a4e4a5bd2075e8afea83b46c8b50fb36fa77fd302f99100cddb0e087

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f768ee4833f57820eb597a8d7bba4e81.jpg
age
125186
edge-cache-tag
292323703752421487914686378813151746696,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
292323703752421487914686378813151746696,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
439
req-referer
https://ads.taboola.com/
content-length
14392
x-request-id
2a9525d880e72c87a63d2502fb71ae96
x-backend-name
US_nlb106
x-served-by
cache-iad-kjyo7100139-IAD, cache-iad-kjyo7100168-IAD, cache-iad-kcgs7200136-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 07:35:53 GMT
server
nginx
surrogate-reporting
width=380,height=212,bytes=41698,owidth=1000,oheight=600,obytes=370851
x-timer
S1694888541.840377,VS0,VE1
etag
"def53a9107a10286774da7bf08453539"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 1
b00a83a775da16845b637798aa5b422c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b00a83a775da16845b637798aa5b422c.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f96f224f55ce77a223d7bf504b848782067cc044f4a282f4018b5c0f2fa7de24

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b00a83a775da16845b637798aa5b422c.jpg
age
295677
edge-cache-tag
623226419832270396277841342181214964640,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
623226419832270396277841342181214964640,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
328
req-referer
https://www.t-online.de/
content-length
10380
x-request-id
e5dc2b51aa8443f2f6b75b4839723013
x-backend-name
CH_nlb801
x-served-by
cache-iad-kjyo7100039-IAD, cache-iad-kiad7000141-IAD, cache-iad-kiad7000050-IAD, cache-fra-eddf8230109-FRA
last-modified
Tue, 05 Sep 2023 12:56:30 GMT
server
nginx
surrogate-reporting
width=380,height=212,bytes=13968,owidth=1067,oheight=600,obytes=306152
x-timer
S1694888541.840056,VS0,VE1
etag
"c6edc4ceacc2fe5bfc0d6b9479f244fe"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 1
a6590ca37bc1fec802dd00a0c882fae9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
16 KB
17 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a6590ca37bc1fec802dd00a0c882fae9.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
670c9af9f3dca88056da94209d8ca61c0d752fc3d7dbbdb4c232d81897e6d490

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a6590ca37bc1fec802dd00a0c882fae9.jpg
age
3355535
edge-cache-tag
317577014958690662663556388167433737890,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
317577014958690662663556388167433737890,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
117
expiration
expiry-date="Mon, 14 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://cdn.taboola.com/
content-length
16832
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200163-IAD, cache-iad-kjyo7100156-IAD, cache-sna10736-LGB, cache-iad-kcgs7200037-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 14 Jul 2023 17:40:29 GMT
server
nginx
x-timer
S1694888541.840360,VS0,VE1
etag
"335526c839a0a07411d8bd60a000e03d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 303, 1
69eb529db3a684fd0c871bccb855e899.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
27 KB
28 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/69eb529db3a684fd0c871bccb855e899.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5a839b5a6e073a96d1681b1f0f96fba964fe8bda49cc60eda5f748b37fc4b253

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
2
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/69eb529db3a684fd0c871bccb855e899.jpg
age
1408046
edge-cache-tag
546102629353737717267587571376253491136,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
546102629353737717267587571376253491136,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, MISS, HIT
x-envoy-upstream-service-time
159
req-referer
https://www.ksta.de/
content-length
27748
x-request-id
13977f6f0544b77732eb97d4cc307062
x-backend-name
CH_nlb802
x-served-by
cache-iad-kiad7000136-IAD, cache-iad-kjyo7100069-IAD, cache-iad-kjyo7100133-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 30 Aug 2023 05:40:11 GMT
server
nginx
x-timer
S1694888541.840954,VS0,VE2
etag
"dbb441c2644d9a4ffd618c406ff434cf"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 0, 1
f1e1647dc4171bf1f074293f298beb43.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f1e1647dc4171bf1f074293f298beb43.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
39d650fd0482142334e4c72a388b81d6148d10798c7fc2386e7692b679d1ecc0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f1e1647dc4171bf1f074293f298beb43.jpg
age
296070
edge-cache-tag
314962611129485402327426974163761977083,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
314962611129485402327426974163761977083,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, MISS, HIT
x-envoy-upstream-service-time
711
req-referer
https://www.thueringen24.de/
content-length
10656
x-request-id
8ca0ab8337df4cabb5d8d0deb252bda8
x-backend-name
LA_nlb202
x-served-by
cache-iad-kjyo7100092-IAD, cache-iad-kcgs7200077-IAD, cache-lax10667-LGB, cache-iad-kiad7000117-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 28 Aug 2023 12:59:50 GMT
server
nginx
surrogate-reporting
width=380,height=212,bytes=20495,owidth=1067,oheight=600,obytes=137876
x-timer
S1694888541.841162,VS0,VE1
etag
"3ece50cd45526679f96830326d7b2967"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 0, 1
f2b91f7d4d2e06924b55bd6c89cf67d8.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f2b91f7d4d2e06924b55bd6c89cf67d8.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
465f488adc6928721a3cfb9149c1a04e2d1fe1ec672519df94271da85512b9a8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f2b91f7d4d2e06924b55bd6c89cf67d8.jpg
age
109806
edge-cache-tag
574164472977581067855004483749993971401,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
574164472977581067855004483749993971401,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT
x-envoy-upstream-service-time
449
req-referer
https://www.obermain.de/
content-length
7124
x-request-id
2f4bca85b245bb052d37973128a4d262
x-backend-name
CH_nlb801
x-served-by
cache-iad-kiad7000132-IAD, cache-iad-kiad7000139-IAD, cache-iad-kiad7000072-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 08:00:55 GMT
server
nginx
surrogate-reporting
width=380,height=212,bytes=11138,owidth=1920,oheight=1080,obytes=175778
x-timer
S1694888541.854114,VS0,VE1
etag
"16ba40047f221eac99e5cb28910f7e57"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 1
d818f04afbd9ebdf62c6bd52b4c16f69.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d818f04afbd9ebdf62c6bd52b4c16f69.jpeg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cc0d3b25b32badef4ae36e085282e8c2eb6e34e5d035994b504eefd30e6c6e29

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d818f04afbd9ebdf62c6bd52b4c16f69.jpeg
age
1574735
edge-cache-tag
549071134709539405522177109416881562895,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
549071134709539405522177109416881562895,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
340
req-referer
https://www.schwarzwaelder-bote.de/
content-length
9348
x-request-id
c96e4c3199403ac5c352d1d17802c70e
x-backend-name
LA_nlb202
x-served-by
cache-iad-kiad7000159-IAD, cache-iad-kjyo7100105-IAD, cache-sna10735-LGB, cache-iad-kjyo7100054-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 28 Aug 2023 17:07:50 GMT
server
nginx
x-timer
S1694888541.854484,VS0,VE0
etag
"1ea5af15db3d14a2eed1b09bc5c152b5"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 243, 6
62d7131670688917b8c84ef87a953be8.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
18 KB
19 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/62d7131670688917b8c84ef87a953be8.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a6193c2b97fc947477fac5b4a4876de16583c0a634dde96ad32560426ed4975f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/62d7131670688917b8c84ef87a953be8.jpg
age
109790
edge-cache-tag
543952912596574231711466373539085783882,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
cache-tag
543952912596574231711466373539085783882,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, MISS, HIT
x-envoy-upstream-service-time
483
req-referer
https://apnews.com/
content-length
18934
x-request-id
27107cb1ca4bacec0128e255425576fb
x-backend-name
US_nlb105
x-served-by
cache-iad-kiad7000138-IAD, cache-iad-kjyo7100076-IAD, cache-fty13725-FTY, cache-iad-kjyo7100033-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 08:01:23 GMT
server
nginx
surrogate-reporting
width=580,height=323,bytes=27828,owidth=1920,oheight=1080,obytes=234686
x-timer
S1694888541.854472,VS0,VE1
etag
"7675221d15173a2f38a36a1ad06eb53e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 0, 1
eyJpdSI6IjljMzNkOTdjMThmMjU3NjgwMmY3Y2YwMGE3YTI0ZTZmYzViM2FmZGI2ZGZmYmQ5YzA5OTc5Zjk0NzU1NTU3NjYiLCJ3IjoxMDAwLCJoIjo1NTgsImQiOjEuMCwiY3MiOjAsImYiOjB9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//images.outbrainimg.com/transform/v3/
18 KB
19 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//images.outbrainimg.com/transform/v3/eyJpdSI6IjljMzNkOTdjMThmMjU3NjgwMmY3Y2YwMGE3YTI0ZTZmYzViM2FmZGI2ZGZmYmQ5YzA5OTc5Zjk0NzU1NTU3NjYiLCJ3IjoxMDAwLCJoIjo1NTgsImQiOjEuMCwiY3MiOjAsImYiOjB9.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cc8f971a86896a467741bf384dbd4386754892b8c71b775c2519d295ce224c7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//images.outbrainimg.com/transform/v3/eyJpdSI6IjljMzNkOTdjMThmMjU3NjgwMmY3Y2YwMGE3YTI0ZTZmYzViM2FmZGI2ZGZmYmQ5YzA5OTc5Zjk0NzU1NTU3NjYiLCJ3IjoxMDAwLCJoIjo1NTgsImQiOjEuMCwiY3MiOjAsImYiOjB9.jpg
age
2694342
edge-cache-tag
495139239821311341137997020229047688968,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
495139239821311341137997020229047688968,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
359
expiration
expiry-date="Thu, 17 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://drivepedia.com/trending/petty-revenge-satisfying-spt-ai/?utm_campaign=Petty+Revenge-A+%7C+PBA+%7C+2608+%7C+ESP+%7C+Funny+%7C+INHS+Dynamic+B2B+1548+VCM+b4ea+-+Unknown+WW+FB+VCM&utm_source=Facebook&utm_medium=Facebook_Mobile_Feed&utm_content=23858223316270353&network_code=VCM&site_code=DR&hashed_lean_url=c4a68481b940cdd7d13605a25a9234b1&ppc=1&c1=23858223311300353&c2=23858223311930353&c3=23858223316270353&v=1&fbclid=IwAR15Hq7uIczurpJRpnG12ChfDbnuTv5AlHSpMgCd4iKK9ivNYkzueWaCevA_aem_ATM38a-VkpAfnSsF-cl1BCH0J0k_wsIt9egXBY7z2SecUvgmCRO8ACaKLYVdjLPmpjnnDoftuN9FOLmFBflUdXK-
content-length
18328
x-backend-name
CH_nlb803
x-served-by
cache-iad-kiad7000110-IAD, cache-iad-kjyo7100159-IAD, cache-fty13722-FTY, cache-iad-kcgs7200131-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 17 Jul 2023 13:30:22 GMT
server
nginx
x-timer
S1694888541.854460,VS0,VE1
etag
"f6a690a346bb6c41e9e47bd7831c2dd4"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 29, 0, 4, 1
0b125ae102a48c12cd82c638701a8dd5.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
17 KB
18 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0b125ae102a48c12cd82c638701a8dd5.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4c5b3602ae50fe7e3db7088031b1c0f7b628ab60a6b06605281fad0ecd7c4840

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
3
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0b125ae102a48c12cd82c638701a8dd5.png
age
2021711
edge-cache-tag
618196746256901993531606316580944870800,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
618196746256901993531606316580944870800,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
121
req-referer
https://news.ltn.com.tw/
content-length
17762
x-request-id
18f3b298e36e7eb17512f120bee03ca9
x-backend-name
CH_nlb803
x-served-by
cache-iad-kcgs7200076-IAD, cache-iad-kjyo7100049-IAD, cache-iad-kiad7000168-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 02 Aug 2023 18:45:32 GMT
server
nginx
x-timer
S1694888541.854466,VS0,VE3
etag
"16b739a7f784492c3c2dc472c44fec26"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 0, 23, 1
7b9aa8c63fad9951d0a9c60222f4daf3.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
6 KB
7 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7b9aa8c63fad9951d0a9c60222f4daf3.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
57503912b5baa2dc7f82654deea8c4e0dc02d5c9307f340ba693d4be28c544a0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
2
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7b9aa8c63fad9951d0a9c60222f4daf3.jpg
age
3944041
edge-cache-tag
531169037454344523287021612944089575468,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
531169037454344523287021612944089575468,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
537
req-referer
https://www.thepinknews.com/
content-length
6278
x-request-id
37261a56801440ba3d9a51e2795c421b
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200035-IAD, cache-iad-kiad7000044-IAD, cache-lax10666-LGB, cache-iad-kcgs7200092-IAD, cache-fra-eddf8230109-FRA
last-modified
Sun, 30 Jul 2023 11:27:20 GMT
server
nginx
x-timer
S1694888541.854419,VS0,VE2
etag
"674b12b48b5d4c4521293cd26dfc937a"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 42, 1
84e4102a7f56cae28d1dc6eb07436e4f.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/84e4102a7f56cae28d1dc6eb07436e4f.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
6d67b67282c6ee3fecf5d2837f3f4f05d35fc863fa9aef17639494ae36e0aafb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/84e4102a7f56cae28d1dc6eb07436e4f.png
age
1600050
edge-cache-tag
308043469987221196075749753963779027404,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
308043469987221196075749753963779027404,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
235
expiration
expiry-date="Sun, 10 Sep 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.saechsische.de/
content-length
7524
x-backend-name
CH_nlb804
x-served-by
cache-iad-kcgs7200046-IAD, cache-iad-kiad7000049-IAD, cache-iad-kcgs7200067-IAD, cache-fra-eddf8230109-FRA
last-modified
Thu, 10 Aug 2023 10:58:34 GMT
server
nginx
x-timer
S1694888541.866151,VS0,VE1
etag
"81945a344f902fc59b399753b77c374d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 22, 1
pazienza.jpg%3Fw%3D753%26h%3D418
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/03/
37 KB
38 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/03/pazienza.jpg%3Fw%3D753%26h%3D418
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3c1d802559944b61cc07ab614481c2845100fb437102061d3d5895c6706a9e9b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/03/pazienza.jpg%3Fw%3D753%26h%3D418
age
1989819
edge-cache-tag
398942707944865916293961363577267526544,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
398942707944865916293961363577267526544,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
479
req-referer
https://www.mercurynews.com/
content-length
38314
x-request-id
389c5b3b3a7e7a3e95e51985a617ddd8
x-backend-name
US_nlb103
x-served-by
cache-iad-kcgs7200131-IAD, cache-iad-kcgs7200131-IAD, cache-lga21954-LGA, cache-iad-kcgs7200100-IAD, cache-fra-eddf8230109-FRA
last-modified
Thu, 24 Aug 2023 17:06:28 GMT
server
nginx
x-timer
S1694888541.866149,VS0,VE0
etag
"036188d7b08424ef22af5f51df90a491"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 21, 1, 64, 2
FurnessJackman.jpg%3Fw%3D1024%26h%3D707
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/04/
45 KB
46 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/04/FurnessJackman.jpg%3Fw%3D1024%26h%3D707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c614e01a3542201b8293054ba6b023c499fa1fd71bfcd9913ad0eb1d9d538566

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/04/FurnessJackman.jpg%3Fw%3D1024%26h%3D707
age
76025
edge-cache-tag
536671003375888980339649374919304773508,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
536671003375888980339649374919304773508,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
965
req-referer
https://www.mercurynews.com/
content-length
46010
x-request-id
61971be6730e6f17021dbc1642529ef9
x-backend-name
CH_nlb802
x-served-by
cache-iad-kiad7000054-IAD, cache-iad-kiad7000022-IAD, cache-iad-kjyo7100029-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 21:06:21 GMT
server
nginx
surrogate-reporting
width=1024,height=512,bytes=37613,owidth=1024,oheight=707,obytes=39564
x-timer
S1694888541.866277,VS0,VE0
etag
"b65939093cff9fc27d6d7a8d1e518d7d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 79, 2
miss-manners-1500px.png%3Fw%3D1024%26h%3D703
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/07/
18 KB
19 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/07/miss-manners-1500px.png%3Fw%3D1024%26h%3D703
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0003f7a90bac27bf9db67d824ccb4a6e8e9c05cf841b1c2ef342554c1088c03f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/07/miss-manners-1500px.png%3Fw%3D1024%26h%3D703
age
1585474
edge-cache-tag
604626748616627948171584547326556373079,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
604626748616627948171584547326556373079,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
474
req-referer
https://www.mercurynews.com/
content-length
18728
x-request-id
afd5ca85295e79b9ba0195191060f379
x-backend-name
CH_nlb801
x-served-by
cache-iad-kiad7000162-IAD, cache-iad-kjyo7100084-IAD, cache-iad-kjyo7100115-IAD, cache-fra-eddf8230109-FRA
last-modified
Tue, 29 Aug 2023 09:57:47 GMT
server
nginx
x-timer
S1694888541.866504,VS0,VE1
etag
"29bc96654887c42989913af46c594a6b"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 11, 1
MelaniaTrump2021.jpg%3Fw%3D1024%26h%3D683
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/04/
36 KB
37 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/04/MelaniaTrump2021.jpg%3Fw%3D1024%26h%3D683
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f45f32a66717afe2f3b53cd741ed6d8802a4e4cb4731a3d44c6428621af7aece

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/04/MelaniaTrump2021.jpg%3Fw%3D1024%26h%3D683
age
873861
edge-cache-tag
488060766032139168527795691495040959164,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
488060766032139168527795691495040959164,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
587
req-referer
https://www.mercurynews.com/
content-length
36668
x-request-id
d66ac98a9898d3f4aaf0c9d95d14f272
x-backend-name
CH_nlb801
x-served-by
cache-iad-kiad7000151-IAD, cache-iad-kiad7000114-IAD, cache-iad-kiad7000070-IAD, cache-fra-eddf8230109-FRA
last-modified
Sat, 26 Aug 2023 21:55:41 GMT
server
nginx
x-timer
S1694888541.866554,VS0,VE1
etag
"f75adaaf2167d847b204bf854c0cbba4"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 3, 1
amy1500px-1.jpg%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/
28 KB
29 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/amy1500px-1.jpg%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
6efef9bc262d0ff2742b3f3d031c23c5e329af2e81b91eee6058835d45365ff5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
5
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/amy1500px-1.jpg%3Fw%3D1024%26h%3D614
age
3821716
edge-cache-tag
485754132747880822204577631642342717124,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
485754132747880822204577631642342717124,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
336
expiration
expiry-date="Tue, 08 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.mercurynews.com/
content-length
28472
x-backend-name
LA_nlb204
x-served-by
cache-iad-kiad7000020-IAD, cache-iad-kiad7000133-IAD, cache-lax10654-LGB, cache-iad-kiad7000173-IAD, cache-fra-eddf8230109-FRA
last-modified
Sat, 08 Jul 2023 14:40:28 GMT
server
nginx
x-timer
S1694888541.866581,VS0,VE5
etag
"0ae6bf7a52e5851e80c7326845b0684d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 12, 1, 1, 1
a32b15b645f4107e169ceaa04b9011e5.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
185 KB
186 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a32b15b645f4107e169ceaa04b9011e5.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5e97284162b8feab4655d445aa676825b2d70dc72324ba1df3032c936c0586b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
3
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a32b15b645f4107e169ceaa04b9011e5.jpg
age
3269241
edge-cache-tag
313702969523318988065151788664381738762,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
313702969523318988065151788664381738762,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
699
expiration
expiry-date="Mon, 14 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.nbcconnecticut.com/
content-length
189116
x-backend-name
CH_nlb804
x-served-by
cache-iad-kcgs7200061-IAD, cache-iad-kiad7000155-IAD, cache-iad-kiad7000027-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 14 Jul 2023 17:22:49 GMT
server
nginx
x-timer
S1694888541.882563,VS0,VE3
etag
"4a8116e9be3a85588205b7c0930221d9"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 39, 1
f768ee4833f57820eb597a8d7bba4e81.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
108 KB
109 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f768ee4833f57820eb597a8d7bba4e81.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b50ec7e9f4cbb719ea8e0d7d191782eece40414875810acbfa602794751a5ec4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f768ee4833f57820eb597a8d7bba4e81.jpg
age
116849
edge-cache-tag
292323703752421487914686378813151746696,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
292323703752421487914686378813151746696,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
529
req-referer
https://cdn.taboola.com/
content-length
110710
x-request-id
7c781914c3141b9220319bc4a9a4a574
x-backend-name
CH_nlb803
x-served-by
cache-iad-kjyo7100103-IAD, cache-iad-kiad7000021-IAD, cache-iad-kjyo7100103-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 07:35:55 GMT
server
nginx
surrogate-reporting
width=1000,height=555,bytes=113646,owidth=1000,oheight=600,obytes=370851
x-timer
S1694888541.882845,VS0,VE0
etag
"25af5f432cd61eb91e6aae1602ff9b9e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1, 2
abby1500px.jpg%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/
16 KB
16 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/abby1500px.jpg%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e234a07894bf7b198119f3994a9961821a75bdee43f64cb42b5be4ca22164055

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/abby1500px.jpg%3Fw%3D1024%26h%3D614
age
3458917
edge-cache-tag
599327998133654055158422142444566160912,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
599327998133654055158422142444566160912,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
642
expiration
expiry-date="Tue, 15 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.mercurynews.com/
content-length
16098
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kiad7000089-IAD, cache-iad-kiad7000036-IAD, cache-iad-kcgs7200138-IAD, cache-fra-eddf8230109-FRA
last-modified
Sat, 15 Jul 2023 16:31:27 GMT
server
nginx
x-timer
S1694888541.882845,VS0,VE1
etag
"8bb8871d839ff267f6b5504ea320ddb3"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 75, 1
MillerBodeandMorgan.jpg%3Fw%3D1024%26h%3D671
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2018/07/
69 KB
69 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2018/07/MillerBodeandMorgan.jpg%3Fw%3D1024%26h%3D671
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4cbab0bee86aa4bd4bd6d9bb6fe0002a85b9c27afde6f863ab139048e37400cd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
2
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2018/07/MillerBodeandMorgan.jpg%3Fw%3D1024%26h%3D671
age
3308087
edge-cache-tag
546945786973754236822323508425888586747,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
546945786973754236822323508425888586747,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
639
expiration
expiry-date="Mon, 28 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.mercurynews.com/
content-length
70294
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kiad7000051-IAD, cache-iad-kiad7000129-IAD, cache-iad-kcgs7200082-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 28 Jul 2023 17:04:12 GMT
server
nginx
x-timer
S1694888541.882993,VS0,VE2
etag
"5933f0232974cac3b9b4d968d249e41d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 45, 1
iceberglake-listing.png%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/
118 KB
118 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/iceberglake-listing.png%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
675371a6e4ce4e3907ce894a5730ac84e011c3ff5d9358f5e7991f105d3a4260

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
3
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/iceberglake-listing.png%3Fw%3D1024%26h%3D614
age
2082908
edge-cache-tag
501220519914288058722382280021978667394,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
501220519914288058722382280021978667394,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
465
req-referer
https://www.mercurynews.com/
content-length
120334
x-request-id
48089704a5054ed7bb30ec578917f3be
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kjyo7100111-IAD, cache-iad-kcgs7200020-IAD, cache-sna10720-LGB, cache-iad-kiad7000145-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 23 Aug 2023 15:47:12 GMT
server
nginx
x-timer
S1694888541.883116,VS0,VE3
etag
"39aad20ae1c4606084aff8336cebffd6"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 41, 1
frugals-listing.png%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/
74 KB
75 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/frugals-listing.png%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3685b0d2d30a73cb28673877c8cc72756fa8783836687c0c78108dcf29cdf0b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
2
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/frugals-listing.png%3Fw%3D1024%26h%3D614
age
2079775
edge-cache-tag
574830251883341716588023083707572298020,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
574830251883341716588023083707572298020,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
462
req-referer
https://www.mercurynews.com/
content-length
75954
x-request-id
7b7dface9a1112b404cc452a87754c52
x-backend-name
LA_nlb204
x-served-by
cache-iad-kiad7000150-IAD, cache-iad-kiad7000077-IAD, cache-sna10725-LGB, cache-iad-kcgs7200149-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 23 Aug 2023 16:39:26 GMT
server
nginx
x-timer
S1694888541.883340,VS0,VE2
etag
"ee27b9a2c194697cb2a1ec6bc4537fab"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 17, 1
harriet1500px.jpg%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/
25 KB
25 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/harriet1500px.jpg%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
6dbc46474fe4c5c63cf48d8f0366b393e0bd23ab359ab547d373079512959126

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
2
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/harriet1500px.jpg%3Fw%3D1024%26h%3D614
age
1490676
edge-cache-tag
395526842995013890152543120513637345232,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
395526842995013890152543120513637345232,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
587
req-referer
https://www.mercurynews.com/
content-length
25286
x-request-id
998cbd61f8dbb91d3adb2c2f154ce144
x-backend-name
CH_nlb804
x-served-by
cache-iad-kiad7000142-IAD, cache-iad-kjyo7100064-IAD, cache-iad-kiad7000026-IAD, cache-fra-eddf8230109-FRA
last-modified
Sat, 26 Aug 2023 12:22:15 GMT
server
nginx
x-timer
S1694888541.898626,VS0,VE2
etag
"ecb44a39dbccfd67de72511a7c59e73b"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 34, 1
a6590ca37bc1fec802dd00a0c882fae9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
45 KB
45 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a6590ca37bc1fec802dd00a0c882fae9.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
074bbd0dd05f675add796b4572b8f3ec1827dcc1c17cbc203b35b9acc4b01d49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a6590ca37bc1fec802dd00a0c882fae9.jpg
age
2800725
edge-cache-tag
317577014958690662663556388167433737890,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
317577014958690662663556388167433737890,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
HIT, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
614
req-referer
https://www.liverpoolecho.co.uk/
content-length
45682
x-request-id
2eacaad12a27b59f63d182156c4d6049
x-backend-name
LA_nlb203
x-served-by
cache-iad-kjyo7100156-IAD, cache-iad-kjyo7100156-IAD, cache-lax10641-LGB, cache-iad-kjyo7100084-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 14 Aug 2023 22:20:29 GMT
server
nginx
x-timer
S1694888541.899241,VS0,VE0
etag
"335526c839a0a07411d8bd60a000e03d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 17, 1, 73, 3574
69eb529db3a684fd0c871bccb855e899.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
84 KB
85 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/69eb529db3a684fd0c871bccb855e899.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a576a611858274b01aeb1c6beddc745964205e3a5d955088c8c5163dc0d654a2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
2
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/69eb529db3a684fd0c871bccb855e899.jpg
age
1408045
edge-cache-tag
546102629353737717267587571376253491136,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
546102629353737717267587571376253491136,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, MISS, HIT
x-envoy-upstream-service-time
538
req-referer
https://cdn.taboola.com/
content-length
86370
x-request-id
13977f6f0544b77732eb97d4cc307062
x-backend-name
CH_nlb804
x-served-by
cache-iad-kiad7000136-IAD, cache-iad-kjyo7100068-IAD, cache-iad-kiad7000031-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 30 Aug 2023 05:40:11 GMT
server
nginx
x-timer
S1694888541.900532,VS0,VE2
etag
"dbb441c2644d9a4ffd618c406ff434cf"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 0, 1
OnPaste.20230829-024133.jpg%3Fw%3D1024%26h%3D619
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/
28 KB
28 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/OnPaste.20230829-024133.jpg%3Fw%3D1024%26h%3D619
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f39747a909c8b87831f585d5930385facbbecdc9badbd18c464195c4272b8d59

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/OnPaste.20230829-024133.jpg%3Fw%3D1024%26h%3D619
age
1538488
edge-cache-tag
354467468990702733280249495686103970213,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
354467468990702733280249495686103970213,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
673
req-referer
https://www.mercurynews.com/
content-length
28428
x-request-id
a072d1299a036ee39bcc64baea621214
x-backend-name
CH_nlb804
x-served-by
cache-iad-kcgs7200173-IAD, cache-iad-kjyo7100065-IAD, cache-iad-kjyo7100179-IAD, cache-fra-eddf8230109-FRA
last-modified
Tue, 29 Aug 2023 23:00:52 GMT
server
nginx
x-timer
S1694888541.901320,VS0,VE1
etag
"1495749f6c309e03198ac8b4ffd9ad82"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 19, 1
musk4.jpg%3Fw%3D620%26h%3D418
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/
39 KB
40 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/musk4.jpg%3Fw%3D620%26h%3D418
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
36ff92531f15c249815b6b0b5ac0728419c25d626a3f54ff40111031b3ebf10f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
2
date
Sat, 16 Sep 2023 18:22:20 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/musk4.jpg%3Fw%3D620%26h%3D418
age
426007
edge-cache-tag
499267841495605413871576870007693807335,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
499267841495605413871576870007693807335,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
413
req-referer
https://www.mercurynews.com/
content-length
40352
x-request-id
ce2edccc0544e90d47b3efaa4e2e4a4c
x-backend-name
LA_nlb201
x-served-by
cache-iad-kiad7000097-IAD, cache-iad-kiad7000034-IAD, cache-sna10739-LGB, cache-iad-kjyo7100158-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 11 Sep 2023 19:45:45 GMT
server
nginx
surrogate-reporting
width=620,height=344,owidth=620,oheight=418,obytes=158343
x-timer
S1694888541.903071,VS0,VE2
etag
"7ad9bd8dd7b7339ff907e7ae1bbc3c5e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 58, 1
972d2c67-1894-4511-bad6-bc1ded788e4d
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/972d2c67-1894-4511-bad6-bc1ded788e4d
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
99291c95-bad1-4f8a-850d-f05d4e743263
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/99291c95-bad1-4f8a-850d-f05d4e743263
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
aa3aaa5f-543b-4a35-ac11-01767b24fa29
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/aa3aaa5f-543b-4a35-ac11-01767b24fa29
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
7a413e70-ae6d-456b-8c18-f56883ca17ad
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/7a413e70-ae6d-456b-8c18-f56883ca17ad
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
ab5f1e3c-617c-47b9-941a-33081d6d0cdf
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/ab5f1e3c-617c-47b9-941a-33081d6d0cdf
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
css
fonts.googleapis.com/
2 KB
440 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Lato:400,700,900&display=swap
Requested by
Host: client
URL: about:client
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0cee972f52f443216ed569505738e89b08925201f31b5d7a51783ee9a0dcc785
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 16 Sep 2023 18:22:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 16 Sep 2023 17:33:23 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 16 Sep 2023 18:22:21 GMT
f3ae626ec77970146d5f9e6fb5d766e737b4069a
tqe36.flx10.com/ Frame AA29
71 KB
71 KB
Font
General
Full URL
https://tqe36.flx10.com/f3ae626ec77970146d5f9e6fb5d766e737b4069a?subset=RESULT%20AIN%212ndD%27%0A%E2%80%8BCHOW
Requested by
Host: tj6w5.flx10.com
URL: https://tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/320x50/?cacheBuster=1984593769&destUrl=https%3A%2F%2Fwww.bestinsv.com%2F%3Futm_source%3Dbang%26utm_medium%3Dbanner&clickTracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvkiQ7D7KFxM4264W1Cyahqox5onN5PFF9o4rrm_gc7w_CK3KYRcDyrdUDHPbn3mh4hBVNAAmuYnDdxLy7BShhDAsN4K0_tu0bRthhSq5Bqi4wjrarZlZw03pdp2D-axevZIUSoSQBcIMx6J7qydOJRH5RzRRGx1_GVGF4mfa0AxCHeMx-7ZPkKcYpEDnquILrjU8uYbno83LBP-eOnIjftAVRZrzEHSYKQxIuUlVDAIiV8zIY8OGQv1bLTwvY9TOmabeffsI9717i884nKTrUxJypG3zi6mFqlBMRWaw_J2y7KNA96mOWkjS7W-3z4gHdGkiSG_K0DoLGR1pEkkiVRRfXS8X7ulhmvoHUU-CzNcSDw2_o7Tk8Pb4ywbkDv%26sai%3DAMfl-YRELPywSbkwYLDBBDrkZ3DQmPxiVMZdr-NJLNhNpKz2AmoqZpBzyQOy-zrBLStY-o5I908TyjZqM2cX0Q57PQ-2dx9n69vfQmC8-g%26sig%3DCg0ArKJSzHlXSFUPLDV4EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
AmazonS3 /
Resource Hash
cd745fcc8b0238d900dbf1d6774fead42beb5b5383bf040833d3afc135f2aee3

Request headers

Referer
https://tj6w5.flx10.com/
Origin
https://tj6w5.flx10.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:21 GMT
last-modified
Mon, 18 Nov 2019 19:06:23 GMT
server
AmazonS3
x-amz-request-id
CVFPF3PXEGPV9A84
etag
"d3d7cfb02715d619fec2a11e7d4bcbb4"
x-hw
1694888541.cds247.fr8.hn,1694888541.cds098.fr8.c
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
72560
x-amz-id-2
M29Cs1JreVIEePk2aCBHahEdx3V6GLgysiPpnj7M1+NIsWUcCAY8PACBMhBEqFNaEvmoAkHL95U=
af8b1057021969c81e57f88d0ce7c27f54c4a95e
tqe36.flx10.com/ Frame AA29
60 KB
60 KB
Font
General
Full URL
https://tqe36.flx10.com/af8b1057021969c81e57f88d0ce7c27f54c4a95e?subset=%E2%80%8BSE%20WINRH%21uportLcalBsine
Requested by
Host: tj6w5.flx10.com
URL: https://tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/320x50/?cacheBuster=1984593769&destUrl=https%3A%2F%2Fwww.bestinsv.com%2F%3Futm_source%3Dbang%26utm_medium%3Dbanner&clickTracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvkiQ7D7KFxM4264W1Cyahqox5onN5PFF9o4rrm_gc7w_CK3KYRcDyrdUDHPbn3mh4hBVNAAmuYnDdxLy7BShhDAsN4K0_tu0bRthhSq5Bqi4wjrarZlZw03pdp2D-axevZIUSoSQBcIMx6J7qydOJRH5RzRRGx1_GVGF4mfa0AxCHeMx-7ZPkKcYpEDnquILrjU8uYbno83LBP-eOnIjftAVRZrzEHSYKQxIuUlVDAIiV8zIY8OGQv1bLTwvY9TOmabeffsI9717i884nKTrUxJypG3zi6mFqlBMRWaw_J2y7KNA96mOWkjS7W-3z4gHdGkiSG_K0DoLGR1pEkkiVRRfXS8X7ulhmvoHUU-CzNcSDw2_o7Tk8Pb4ywbkDv%26sai%3DAMfl-YRELPywSbkwYLDBBDrkZ3DQmPxiVMZdr-NJLNhNpKz2AmoqZpBzyQOy-zrBLStY-o5I908TyjZqM2cX0Q57PQ-2dx9n69vfQmC8-g%26sig%3DCg0ArKJSzHlXSFUPLDV4EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
AmazonS3 /
Resource Hash
a1ff5bcbdd5695b6d3d4dc997c516846a50989edd2e34f8691cc301ed4e8fca5

Request headers

Referer
https://tj6w5.flx10.com/
Origin
https://tj6w5.flx10.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:21 GMT
last-modified
Mon, 18 Nov 2019 19:06:15 GMT
server
AmazonS3
x-amz-request-id
CVFMKH7AGTXE0089
etag
"ffa7bf00cfb697337cbdff38ecc4d2aa"
x-hw
1694888541.cds247.fr8.hn,1694888541.cds016.fr8.c
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
61484
x-amz-id-2
ITgrxipGuv7YB91blgZ/9Pj67YHJwcEkU3sftKYW9VQCS1lmIyQTuqn+e3VbUmnT29NiIgrUOlo=
a32b15b645f4107e169ceaa04b9011e5.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
23 KB
24 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a32b15b645f4107e169ceaa04b9011e5.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
75b9f7cb9145ab6ba7dab006ea44900ba52c69191d2fc9dfc14c534980c07965

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a32b15b645f4107e169ceaa04b9011e5.jpg
age
5138512
edge-cache-tag
313702969523318988065151788664381738762,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
313702969523318988065151788664381738762,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
475
req-referer
https://games.espn.com/
content-length
23526
x-request-id
41768da8a0210e262177e7606a58b08a
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb802
x-served-by
cache-iad-kjyo7100164-IAD, cache-iad-kcgs7200121-IAD, cache-chi-kigq8000046-CHI, cache-iad-kjyo7100081-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 14 Jul 2023 17:19:18 GMT
server
nginx
x-timer
S1694888542.690754,VS0,VE0
etag
"22c554afb3ca75d825f3d90ffcf42408"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 46, 2
f768ee4833f57820eb597a8d7bba4e81.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
14 KB
15 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f768ee4833f57820eb597a8d7bba4e81.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
63f681f0a4e4a5bd2075e8afea83b46c8b50fb36fa77fd302f99100cddb0e087

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f768ee4833f57820eb597a8d7bba4e81.jpg
age
125187
edge-cache-tag
292323703752421487914686378813151746696,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
292323703752421487914686378813151746696,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
439
req-referer
https://ads.taboola.com/
content-length
14392
x-request-id
2a9525d880e72c87a63d2502fb71ae96
x-backend-name
US_nlb106
x-served-by
cache-iad-kjyo7100139-IAD, cache-iad-kjyo7100168-IAD, cache-iad-kcgs7200136-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 07:35:53 GMT
server
nginx
surrogate-reporting
width=380,height=212,bytes=41698,owidth=1000,oheight=600,obytes=370851
x-timer
S1694888542.690922,VS0,VE0
etag
"def53a9107a10286774da7bf08453539"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 2
b00a83a775da16845b637798aa5b422c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b00a83a775da16845b637798aa5b422c.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f96f224f55ce77a223d7bf504b848782067cc044f4a282f4018b5c0f2fa7de24

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b00a83a775da16845b637798aa5b422c.jpg
age
295678
edge-cache-tag
623226419832270396277841342181214964640,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
623226419832270396277841342181214964640,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
328
req-referer
https://www.t-online.de/
content-length
10380
x-request-id
e5dc2b51aa8443f2f6b75b4839723013
x-backend-name
CH_nlb801
x-served-by
cache-iad-kjyo7100039-IAD, cache-iad-kiad7000141-IAD, cache-iad-kiad7000050-IAD, cache-fra-eddf8230109-FRA
last-modified
Tue, 05 Sep 2023 12:56:30 GMT
server
nginx
surrogate-reporting
width=380,height=212,bytes=13968,owidth=1067,oheight=600,obytes=306152
x-timer
S1694888542.691518,VS0,VE0
etag
"c6edc4ceacc2fe5bfc0d6b9479f244fe"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 2
a6590ca37bc1fec802dd00a0c882fae9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
16 KB
17 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a6590ca37bc1fec802dd00a0c882fae9.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
670c9af9f3dca88056da94209d8ca61c0d752fc3d7dbbdb4c232d81897e6d490

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a6590ca37bc1fec802dd00a0c882fae9.jpg
age
3355536
edge-cache-tag
317577014958690662663556388167433737890,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
317577014958690662663556388167433737890,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
117
expiration
expiry-date="Mon, 14 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://cdn.taboola.com/
content-length
16832
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200163-IAD, cache-iad-kjyo7100156-IAD, cache-sna10736-LGB, cache-iad-kcgs7200037-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 14 Jul 2023 17:40:29 GMT
server
nginx
x-timer
S1694888542.691836,VS0,VE0
etag
"335526c839a0a07411d8bd60a000e03d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 303, 2
69eb529db3a684fd0c871bccb855e899.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
27 KB
28 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/69eb529db3a684fd0c871bccb855e899.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5a839b5a6e073a96d1681b1f0f96fba964fe8bda49cc60eda5f748b37fc4b253

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/69eb529db3a684fd0c871bccb855e899.jpg
age
1408047
edge-cache-tag
546102629353737717267587571376253491136,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
546102629353737717267587571376253491136,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, MISS, HIT
x-envoy-upstream-service-time
159
req-referer
https://www.ksta.de/
content-length
27748
x-request-id
13977f6f0544b77732eb97d4cc307062
x-backend-name
CH_nlb802
x-served-by
cache-iad-kiad7000136-IAD, cache-iad-kjyo7100069-IAD, cache-iad-kjyo7100133-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 30 Aug 2023 05:40:11 GMT
server
nginx
x-timer
S1694888542.692044,VS0,VE0
etag
"dbb441c2644d9a4ffd618c406ff434cf"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 0, 2
f1e1647dc4171bf1f074293f298beb43.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f1e1647dc4171bf1f074293f298beb43.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
39d650fd0482142334e4c72a388b81d6148d10798c7fc2386e7692b679d1ecc0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f1e1647dc4171bf1f074293f298beb43.jpg
age
296071
edge-cache-tag
314962611129485402327426974163761977083,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
314962611129485402327426974163761977083,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, MISS, HIT
x-envoy-upstream-service-time
711
req-referer
https://www.thueringen24.de/
content-length
10656
x-request-id
8ca0ab8337df4cabb5d8d0deb252bda8
x-backend-name
LA_nlb202
x-served-by
cache-iad-kjyo7100092-IAD, cache-iad-kcgs7200077-IAD, cache-lax10667-LGB, cache-iad-kiad7000117-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 28 Aug 2023 12:59:50 GMT
server
nginx
surrogate-reporting
width=380,height=212,bytes=20495,owidth=1067,oheight=600,obytes=137876
x-timer
S1694888542.692173,VS0,VE0
etag
"3ece50cd45526679f96830326d7b2967"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 0, 2
f2b91f7d4d2e06924b55bd6c89cf67d8.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f2b91f7d4d2e06924b55bd6c89cf67d8.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
465f488adc6928721a3cfb9149c1a04e2d1fe1ec672519df94271da85512b9a8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f2b91f7d4d2e06924b55bd6c89cf67d8.jpg
age
109807
edge-cache-tag
574164472977581067855004483749993971401,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
574164472977581067855004483749993971401,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT
x-envoy-upstream-service-time
449
req-referer
https://www.obermain.de/
content-length
7124
x-request-id
2f4bca85b245bb052d37973128a4d262
x-backend-name
CH_nlb801
x-served-by
cache-iad-kiad7000132-IAD, cache-iad-kiad7000139-IAD, cache-iad-kiad7000072-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 08:00:55 GMT
server
nginx
surrogate-reporting
width=380,height=212,bytes=11138,owidth=1920,oheight=1080,obytes=175778
x-timer
S1694888542.704660,VS0,VE0
etag
"16ba40047f221eac99e5cb28910f7e57"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 2
d818f04afbd9ebdf62c6bd52b4c16f69.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d818f04afbd9ebdf62c6bd52b4c16f69.jpeg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cc0d3b25b32badef4ae36e085282e8c2eb6e34e5d035994b504eefd30e6c6e29

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d818f04afbd9ebdf62c6bd52b4c16f69.jpeg
age
1574736
edge-cache-tag
549071134709539405522177109416881562895,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
549071134709539405522177109416881562895,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
340
req-referer
https://www.schwarzwaelder-bote.de/
content-length
9348
x-request-id
c96e4c3199403ac5c352d1d17802c70e
x-backend-name
LA_nlb202
x-served-by
cache-iad-kiad7000159-IAD, cache-iad-kjyo7100105-IAD, cache-sna10735-LGB, cache-iad-kjyo7100054-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 28 Aug 2023 17:07:50 GMT
server
nginx
x-timer
S1694888542.705324,VS0,VE0
etag
"1ea5af15db3d14a2eed1b09bc5c152b5"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 243, 7
62d7131670688917b8c84ef87a953be8.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
18 KB
19 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/62d7131670688917b8c84ef87a953be8.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a6193c2b97fc947477fac5b4a4876de16583c0a634dde96ad32560426ed4975f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/62d7131670688917b8c84ef87a953be8.jpg
age
109791
edge-cache-tag
543952912596574231711466373539085783882,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
cache-tag
543952912596574231711466373539085783882,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, MISS, HIT
x-envoy-upstream-service-time
483
req-referer
https://apnews.com/
content-length
18934
x-request-id
27107cb1ca4bacec0128e255425576fb
x-backend-name
US_nlb105
x-served-by
cache-iad-kiad7000138-IAD, cache-iad-kjyo7100076-IAD, cache-fty13725-FTY, cache-iad-kjyo7100033-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 08:01:23 GMT
server
nginx
surrogate-reporting
width=580,height=323,bytes=27828,owidth=1920,oheight=1080,obytes=234686
x-timer
S1694888542.705209,VS0,VE0
etag
"7675221d15173a2f38a36a1ad06eb53e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 0, 2
eyJpdSI6IjljMzNkOTdjMThmMjU3NjgwMmY3Y2YwMGE3YTI0ZTZmYzViM2FmZGI2ZGZmYmQ5YzA5OTc5Zjk0NzU1NTU3NjYiLCJ3IjoxMDAwLCJoIjo1NTgsImQiOjEuMCwiY3MiOjAsImYiOjB9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//images.outbrainimg.com/transform/v3/
18 KB
19 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//images.outbrainimg.com/transform/v3/eyJpdSI6IjljMzNkOTdjMThmMjU3NjgwMmY3Y2YwMGE3YTI0ZTZmYzViM2FmZGI2ZGZmYmQ5YzA5OTc5Zjk0NzU1NTU3NjYiLCJ3IjoxMDAwLCJoIjo1NTgsImQiOjEuMCwiY3MiOjAsImYiOjB9.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cc8f971a86896a467741bf384dbd4386754892b8c71b775c2519d295ce224c7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//images.outbrainimg.com/transform/v3/eyJpdSI6IjljMzNkOTdjMThmMjU3NjgwMmY3Y2YwMGE3YTI0ZTZmYzViM2FmZGI2ZGZmYmQ5YzA5OTc5Zjk0NzU1NTU3NjYiLCJ3IjoxMDAwLCJoIjo1NTgsImQiOjEuMCwiY3MiOjAsImYiOjB9.jpg
age
2694343
edge-cache-tag
495139239821311341137997020229047688968,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
495139239821311341137997020229047688968,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
359
expiration
expiry-date="Thu, 17 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://drivepedia.com/trending/petty-revenge-satisfying-spt-ai/?utm_campaign=Petty+Revenge-A+%7C+PBA+%7C+2608+%7C+ESP+%7C+Funny+%7C+INHS+Dynamic+B2B+1548+VCM+b4ea+-+Unknown+WW+FB+VCM&utm_source=Facebook&utm_medium=Facebook_Mobile_Feed&utm_content=23858223316270353&network_code=VCM&site_code=DR&hashed_lean_url=c4a68481b940cdd7d13605a25a9234b1&ppc=1&c1=23858223311300353&c2=23858223311930353&c3=23858223316270353&v=1&fbclid=IwAR15Hq7uIczurpJRpnG12ChfDbnuTv5AlHSpMgCd4iKK9ivNYkzueWaCevA_aem_ATM38a-VkpAfnSsF-cl1BCH0J0k_wsIt9egXBY7z2SecUvgmCRO8ACaKLYVdjLPmpjnnDoftuN9FOLmFBflUdXK-
content-length
18328
x-backend-name
CH_nlb803
x-served-by
cache-iad-kiad7000110-IAD, cache-iad-kjyo7100159-IAD, cache-fty13722-FTY, cache-iad-kcgs7200131-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 17 Jul 2023 13:30:22 GMT
server
nginx
x-timer
S1694888542.705023,VS0,VE0
etag
"f6a690a346bb6c41e9e47bd7831c2dd4"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 29, 0, 4, 2
0b125ae102a48c12cd82c638701a8dd5.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
17 KB
18 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0b125ae102a48c12cd82c638701a8dd5.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4c5b3602ae50fe7e3db7088031b1c0f7b628ab60a6b06605281fad0ecd7c4840

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0b125ae102a48c12cd82c638701a8dd5.png
age
2021712
edge-cache-tag
618196746256901993531606316580944870800,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
618196746256901993531606316580944870800,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
121
req-referer
https://news.ltn.com.tw/
content-length
17762
x-request-id
18f3b298e36e7eb17512f120bee03ca9
x-backend-name
CH_nlb803
x-served-by
cache-iad-kcgs7200076-IAD, cache-iad-kjyo7100049-IAD, cache-iad-kiad7000168-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 02 Aug 2023 18:45:32 GMT
server
nginx
x-timer
S1694888542.705300,VS0,VE0
etag
"16b739a7f784492c3c2dc472c44fec26"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 0, 23, 2
7b9aa8c63fad9951d0a9c60222f4daf3.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
6 KB
7 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7b9aa8c63fad9951d0a9c60222f4daf3.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
57503912b5baa2dc7f82654deea8c4e0dc02d5c9307f340ba693d4be28c544a0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7b9aa8c63fad9951d0a9c60222f4daf3.jpg
age
3944042
edge-cache-tag
531169037454344523287021612944089575468,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
531169037454344523287021612944089575468,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
537
req-referer
https://www.thepinknews.com/
content-length
6278
x-request-id
37261a56801440ba3d9a51e2795c421b
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200035-IAD, cache-iad-kiad7000044-IAD, cache-lax10666-LGB, cache-iad-kcgs7200092-IAD, cache-fra-eddf8230109-FRA
last-modified
Sun, 30 Jul 2023 11:27:20 GMT
server
nginx
x-timer
S1694888542.705291,VS0,VE0
etag
"674b12b48b5d4c4521293cd26dfc937a"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 42, 2
84e4102a7f56cae28d1dc6eb07436e4f.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/84e4102a7f56cae28d1dc6eb07436e4f.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
6d67b67282c6ee3fecf5d2837f3f4f05d35fc863fa9aef17639494ae36e0aafb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/84e4102a7f56cae28d1dc6eb07436e4f.png
age
1600051
edge-cache-tag
308043469987221196075749753963779027404,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
308043469987221196075749753963779027404,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
235
expiration
expiry-date="Sun, 10 Sep 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.saechsische.de/
content-length
7524
x-backend-name
CH_nlb804
x-served-by
cache-iad-kcgs7200046-IAD, cache-iad-kiad7000049-IAD, cache-iad-kcgs7200067-IAD, cache-fra-eddf8230109-FRA
last-modified
Thu, 10 Aug 2023 10:58:34 GMT
server
nginx
x-timer
S1694888542.718724,VS0,VE0
etag
"81945a344f902fc59b399753b77c374d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 22, 2
pazienza.jpg%3Fw%3D753%26h%3D418
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/03/
37 KB
38 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/03/pazienza.jpg%3Fw%3D753%26h%3D418
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3c1d802559944b61cc07ab614481c2845100fb437102061d3d5895c6706a9e9b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/03/pazienza.jpg%3Fw%3D753%26h%3D418
age
1989820
edge-cache-tag
398942707944865916293961363577267526544,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
398942707944865916293961363577267526544,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
479
req-referer
https://www.mercurynews.com/
content-length
38314
x-request-id
389c5b3b3a7e7a3e95e51985a617ddd8
x-backend-name
US_nlb103
x-served-by
cache-iad-kcgs7200131-IAD, cache-iad-kcgs7200131-IAD, cache-lga21954-LGA, cache-iad-kcgs7200100-IAD, cache-fra-eddf8230109-FRA
last-modified
Thu, 24 Aug 2023 17:06:28 GMT
server
nginx
x-timer
S1694888542.718953,VS0,VE0
etag
"036188d7b08424ef22af5f51df90a491"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 21, 1, 64, 3
FurnessJackman.jpg%3Fw%3D1024%26h%3D707
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/04/
45 KB
46 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/04/FurnessJackman.jpg%3Fw%3D1024%26h%3D707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c614e01a3542201b8293054ba6b023c499fa1fd71bfcd9913ad0eb1d9d538566

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/04/FurnessJackman.jpg%3Fw%3D1024%26h%3D707
age
76026
edge-cache-tag
536671003375888980339649374919304773508,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
536671003375888980339649374919304773508,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
965
req-referer
https://www.mercurynews.com/
content-length
46010
x-request-id
61971be6730e6f17021dbc1642529ef9
x-backend-name
CH_nlb802
x-served-by
cache-iad-kiad7000054-IAD, cache-iad-kiad7000022-IAD, cache-iad-kjyo7100029-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 21:06:21 GMT
server
nginx
surrogate-reporting
width=1024,height=512,bytes=37613,owidth=1024,oheight=707,obytes=39564
x-timer
S1694888542.718919,VS0,VE0
etag
"b65939093cff9fc27d6d7a8d1e518d7d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 79, 3
miss-manners-1500px.png%3Fw%3D1024%26h%3D703
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/07/
18 KB
19 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/07/miss-manners-1500px.png%3Fw%3D1024%26h%3D703
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0003f7a90bac27bf9db67d824ccb4a6e8e9c05cf841b1c2ef342554c1088c03f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/07/miss-manners-1500px.png%3Fw%3D1024%26h%3D703
age
1585475
edge-cache-tag
604626748616627948171584547326556373079,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
604626748616627948171584547326556373079,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
474
req-referer
https://www.mercurynews.com/
content-length
18728
x-request-id
afd5ca85295e79b9ba0195191060f379
x-backend-name
CH_nlb801
x-served-by
cache-iad-kiad7000162-IAD, cache-iad-kjyo7100084-IAD, cache-iad-kjyo7100115-IAD, cache-fra-eddf8230109-FRA
last-modified
Tue, 29 Aug 2023 09:57:47 GMT
server
nginx
x-timer
S1694888542.719321,VS0,VE0
etag
"29bc96654887c42989913af46c594a6b"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 11, 2
MelaniaTrump2021.jpg%3Fw%3D1024%26h%3D683
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/04/
36 KB
37 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/04/MelaniaTrump2021.jpg%3Fw%3D1024%26h%3D683
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f45f32a66717afe2f3b53cd741ed6d8802a4e4cb4731a3d44c6428621af7aece

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/04/MelaniaTrump2021.jpg%3Fw%3D1024%26h%3D683
age
873862
edge-cache-tag
488060766032139168527795691495040959164,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
488060766032139168527795691495040959164,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
587
req-referer
https://www.mercurynews.com/
content-length
36668
x-request-id
d66ac98a9898d3f4aaf0c9d95d14f272
x-backend-name
CH_nlb801
x-served-by
cache-iad-kiad7000151-IAD, cache-iad-kiad7000114-IAD, cache-iad-kiad7000070-IAD, cache-fra-eddf8230109-FRA
last-modified
Sat, 26 Aug 2023 21:55:41 GMT
server
nginx
x-timer
S1694888542.719234,VS0,VE0
etag
"f75adaaf2167d847b204bf854c0cbba4"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 3, 2
f3ae626ec77970146d5f9e6fb5d766e737b4069a
tqe36.flx10.com/ Frame 3702
71 KB
71 KB
Font
General
Full URL
https://tqe36.flx10.com/f3ae626ec77970146d5f9e6fb5d766e737b4069a?subset=RESULT%20AIN%212ndD%27%0A%E2%80%8BCHOW
Requested by
Host: tj6w5.flx10.com
URL: https://tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/728x90/?cacheBuster=15259304&destUrl=https%3A%2F%2Fwww.bestinsv.com%2F%3Futm_source%3Dbang%26utm_medium%3Dbanner&clickTracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstvqDF631KgJowHOx64xtxkaTMIlZz-YrB-YgqIcv0iMw-qu_Lc6Qex_t2idlV2DasQwk1uRGGWIhEg66_-q0woZcgiHRjGyZsgAxu2UD37YzmUdVXfS48eGeG860ducc7decPlB-Lq3xRzHO2xchzyw4s6kjpX7P6mMqup8b2xcW72Z2w_5k3QkXv1qbmb42keqom8Gsmb-EzdrRvO94kTe8cNHrtDu9jT0XEVQTP7yfpzoz24GJi23hOBIdX9ySCsQfl6SsvlvKBA2bBXfdj8D4lS2KKB2-wT5LEzqCxyO1tgWjfOoJzsJGDpiXGavuSOUO6jxbDIens7DKl8JhKYKWlUUngZCpPeUa-Lo5IWZpp4zNI-QtcRg57REgHaILo%26sai%3DAMfl-YTGOz2iUN4lIZsSU0FWZnrqtDFlXALtA77XmD9TvvEsut78UD3JMTSyiqXmW7Qcuqr6NXn_DZAvTC2im78SVXUJ0t5DBmMydjYqgQ%26sig%3DCg0ArKJSzPbuen0I_JexEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
AmazonS3 /
Resource Hash
cd745fcc8b0238d900dbf1d6774fead42beb5b5383bf040833d3afc135f2aee3

Request headers

Referer
https://tj6w5.flx10.com/
Origin
https://tj6w5.flx10.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:21 GMT
last-modified
Mon, 18 Nov 2019 19:06:23 GMT
server
AmazonS3
x-amz-request-id
CVFPF3PXEGPV9A84
etag
"d3d7cfb02715d619fec2a11e7d4bcbb4"
x-hw
1694888541.cds247.fr8.hn,1694888541.cds098.fr8.c
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
72560
x-amz-id-2
M29Cs1JreVIEePk2aCBHahEdx3V6GLgysiPpnj7M1+NIsWUcCAY8PACBMhBEqFNaEvmoAkHL95U=
af8b1057021969c81e57f88d0ce7c27f54c4a95e
tqe36.flx10.com/ Frame 3702
60 KB
60 KB
Font
General
Full URL
https://tqe36.flx10.com/af8b1057021969c81e57f88d0ce7c27f54c4a95e?subset=%E2%80%8BSE%20WINRH%21uportLcalBsine
Requested by
Host: tj6w5.flx10.com
URL: https://tj6w5.flx10.com/v2/K2brmvrqsnx/-/border/false/-/breakpoint/728x90/?cacheBuster=15259304&destUrl=https%3A%2F%2Fwww.bestinsv.com%2F%3Futm_source%3Dbang%26utm_medium%3Dbanner&clickTracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstvqDF631KgJowHOx64xtxkaTMIlZz-YrB-YgqIcv0iMw-qu_Lc6Qex_t2idlV2DasQwk1uRGGWIhEg66_-q0woZcgiHRjGyZsgAxu2UD37YzmUdVXfS48eGeG860ducc7decPlB-Lq3xRzHO2xchzyw4s6kjpX7P6mMqup8b2xcW72Z2w_5k3QkXv1qbmb42keqom8Gsmb-EzdrRvO94kTe8cNHrtDu9jT0XEVQTP7yfpzoz24GJi23hOBIdX9ySCsQfl6SsvlvKBA2bBXfdj8D4lS2KKB2-wT5LEzqCxyO1tgWjfOoJzsJGDpiXGavuSOUO6jxbDIens7DKl8JhKYKWlUUngZCpPeUa-Lo5IWZpp4zNI-QtcRg57REgHaILo%26sai%3DAMfl-YTGOz2iUN4lIZsSU0FWZnrqtDFlXALtA77XmD9TvvEsut78UD3JMTSyiqXmW7Qcuqr6NXn_DZAvTC2im78SVXUJ0t5DBmMydjYqgQ%26sig%3DCg0ArKJSzPbuen0I_JexEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
AmazonS3 /
Resource Hash
a1ff5bcbdd5695b6d3d4dc997c516846a50989edd2e34f8691cc301ed4e8fca5

Request headers

Referer
https://tj6w5.flx10.com/
Origin
https://tj6w5.flx10.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:21 GMT
last-modified
Mon, 18 Nov 2019 19:06:15 GMT
server
AmazonS3
x-amz-request-id
CVFMKH7AGTXE0089
etag
"ffa7bf00cfb697337cbdff38ecc4d2aa"
x-hw
1694888541.cds247.fr8.hn,1694888541.cds016.fr8.c
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
61484
x-amz-id-2
ITgrxipGuv7YB91blgZ/9Pj67YHJwcEkU3sftKYW9VQCS1lmIyQTuqn+e3VbUmnT29NiIgrUOlo=
amy1500px-1.jpg%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/
28 KB
29 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/amy1500px-1.jpg%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
6efef9bc262d0ff2742b3f3d031c23c5e329af2e81b91eee6058835d45365ff5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_750%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/amy1500px-1.jpg%3Fw%3D1024%26h%3D614
age
3821717
edge-cache-tag
485754132747880822204577631642342717124,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
cache-tag
485754132747880822204577631642342717124,618870499114759607638041997254694977048,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
336
expiration
expiry-date="Tue, 08 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.mercurynews.com/
content-length
28472
x-backend-name
LA_nlb204
x-served-by
cache-iad-kiad7000020-IAD, cache-iad-kiad7000133-IAD, cache-lax10654-LGB, cache-iad-kiad7000173-IAD, cache-fra-eddf8230109-FRA
last-modified
Sat, 08 Jul 2023 14:40:28 GMT
server
nginx
x-timer
S1694888542.719337,VS0,VE0
etag
"0ae6bf7a52e5851e80c7326845b0684d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 12, 1, 1, 2
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/
23 KB
23 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 09 Sep 2023 21:18:33 GMT
x-content-type-options
nosniff
age
594228
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23040
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:07:25 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 08 Sep 2024 21:18:33 GMT
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/
23 KB
23 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 09 Sep 2023 21:23:50 GMT
x-content-type-options
nosniff
age
593911
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23580
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:17:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 08 Sep 2024 21:23:50 GMT
16c9110f-92d4-4259-a0e7-697a5684f7e6
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/16c9110f-92d4-4259-a0e7-697a5684f7e6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
a32b15b645f4107e169ceaa04b9011e5.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
185 KB
186 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a32b15b645f4107e169ceaa04b9011e5.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5e97284162b8feab4655d445aa676825b2d70dc72324ba1df3032c936c0586b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a32b15b645f4107e169ceaa04b9011e5.jpg
age
3269242
edge-cache-tag
313702969523318988065151788664381738762,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
313702969523318988065151788664381738762,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
699
expiration
expiry-date="Mon, 14 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.nbcconnecticut.com/
content-length
189116
x-backend-name
CH_nlb804
x-served-by
cache-iad-kcgs7200061-IAD, cache-iad-kiad7000155-IAD, cache-iad-kiad7000027-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 14 Jul 2023 17:22:49 GMT
server
nginx
x-timer
S1694888542.774322,VS0,VE0
etag
"4a8116e9be3a85588205b7c0930221d9"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 39, 2
f768ee4833f57820eb597a8d7bba4e81.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
108 KB
109 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f768ee4833f57820eb597a8d7bba4e81.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b50ec7e9f4cbb719ea8e0d7d191782eece40414875810acbfa602794751a5ec4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f768ee4833f57820eb597a8d7bba4e81.jpg
age
116850
edge-cache-tag
292323703752421487914686378813151746696,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
292323703752421487914686378813151746696,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
529
req-referer
https://cdn.taboola.com/
content-length
110710
x-request-id
7c781914c3141b9220319bc4a9a4a574
x-backend-name
CH_nlb803
x-served-by
cache-iad-kjyo7100103-IAD, cache-iad-kiad7000021-IAD, cache-iad-kjyo7100103-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 15 Sep 2023 07:35:55 GMT
server
nginx
surrogate-reporting
width=1000,height=555,bytes=113646,owidth=1000,oheight=600,obytes=370851
x-timer
S1694888542.774327,VS0,VE0
etag
"25af5f432cd61eb91e6aae1602ff9b9e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1, 3
abby1500px.jpg%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/
16 KB
17 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/abby1500px.jpg%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e234a07894bf7b198119f3994a9961821a75bdee43f64cb42b5be4ca22164055

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/abby1500px.jpg%3Fw%3D1024%26h%3D614
age
3458918
edge-cache-tag
599327998133654055158422142444566160912,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
599327998133654055158422142444566160912,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
642
expiration
expiry-date="Tue, 15 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.mercurynews.com/
content-length
16098
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kiad7000089-IAD, cache-iad-kiad7000036-IAD, cache-iad-kcgs7200138-IAD, cache-fra-eddf8230109-FRA
last-modified
Sat, 15 Jul 2023 16:31:27 GMT
server
nginx
x-timer
S1694888542.774090,VS0,VE0
etag
"8bb8871d839ff267f6b5504ea320ddb3"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 75, 2
MillerBodeandMorgan.jpg%3Fw%3D1024%26h%3D671
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2018/07/
69 KB
69 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2018/07/MillerBodeandMorgan.jpg%3Fw%3D1024%26h%3D671
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4cbab0bee86aa4bd4bd6d9bb6fe0002a85b9c27afde6f863ab139048e37400cd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2018/07/MillerBodeandMorgan.jpg%3Fw%3D1024%26h%3D671
age
3308088
edge-cache-tag
546945786973754236822323508425888586747,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
546945786973754236822323508425888586747,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
639
expiration
expiry-date="Mon, 28 Aug 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.mercurynews.com/
content-length
70294
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kiad7000051-IAD, cache-iad-kiad7000129-IAD, cache-iad-kcgs7200082-IAD, cache-fra-eddf8230109-FRA
last-modified
Fri, 28 Jul 2023 17:04:12 GMT
server
nginx
x-timer
S1694888542.774086,VS0,VE0
etag
"5933f0232974cac3b9b4d968d249e41d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 45, 2
iceberglake-listing.png%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/
118 KB
118 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/iceberglake-listing.png%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
675371a6e4ce4e3907ce894a5730ac84e011c3ff5d9358f5e7991f105d3a4260

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/iceberglake-listing.png%3Fw%3D1024%26h%3D614
age
2082909
edge-cache-tag
501220519914288058722382280021978667394,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
501220519914288058722382280021978667394,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
465
req-referer
https://www.mercurynews.com/
content-length
120334
x-request-id
48089704a5054ed7bb30ec578917f3be
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kjyo7100111-IAD, cache-iad-kcgs7200020-IAD, cache-sna10720-LGB, cache-iad-kiad7000145-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 23 Aug 2023 15:47:12 GMT
server
nginx
x-timer
S1694888542.774069,VS0,VE0
etag
"39aad20ae1c4606084aff8336cebffd6"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 41, 2
frugals-listing.png%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/
74 KB
75 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/frugals-listing.png%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3685b0d2d30a73cb28673877c8cc72756fa8783836687c0c78108dcf29cdf0b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/frugals-listing.png%3Fw%3D1024%26h%3D614
age
2079776
edge-cache-tag
574830251883341716588023083707572298020,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
574830251883341716588023083707572298020,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
462
req-referer
https://www.mercurynews.com/
content-length
75954
x-request-id
7b7dface9a1112b404cc452a87754c52
x-backend-name
LA_nlb204
x-served-by
cache-iad-kiad7000150-IAD, cache-iad-kiad7000077-IAD, cache-sna10725-LGB, cache-iad-kcgs7200149-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 23 Aug 2023 16:39:26 GMT
server
nginx
x-timer
S1694888542.774085,VS0,VE0
etag
"ee27b9a2c194697cb2a1ec6bc4537fab"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 17, 2
harriet1500px.jpg%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/
25 KB
25 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/harriet1500px.jpg%3Fw%3D1024%26h%3D614
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
6dbc46474fe4c5c63cf48d8f0366b393e0bd23ab359ab547d373079512959126

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/harriet1500px.jpg%3Fw%3D1024%26h%3D614
age
1490677
edge-cache-tag
395526842995013890152543120513637345232,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
395526842995013890152543120513637345232,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
587
req-referer
https://www.mercurynews.com/
content-length
25286
x-request-id
998cbd61f8dbb91d3adb2c2f154ce144
x-backend-name
CH_nlb804
x-served-by
cache-iad-kiad7000142-IAD, cache-iad-kjyo7100064-IAD, cache-iad-kiad7000026-IAD, cache-fra-eddf8230109-FRA
last-modified
Sat, 26 Aug 2023 12:22:15 GMT
server
nginx
x-timer
S1694888542.788481,VS0,VE0
etag
"ecb44a39dbccfd67de72511a7c59e73b"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 34, 2
a6590ca37bc1fec802dd00a0c882fae9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
45 KB
45 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a6590ca37bc1fec802dd00a0c882fae9.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
074bbd0dd05f675add796b4572b8f3ec1827dcc1c17cbc203b35b9acc4b01d49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a6590ca37bc1fec802dd00a0c882fae9.jpg
age
2800726
edge-cache-tag
317577014958690662663556388167433737890,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
317577014958690662663556388167433737890,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
HIT, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
614
req-referer
https://www.liverpoolecho.co.uk/
content-length
45682
x-request-id
2eacaad12a27b59f63d182156c4d6049
x-backend-name
LA_nlb203
x-served-by
cache-iad-kjyo7100156-IAD, cache-iad-kjyo7100156-IAD, cache-lax10641-LGB, cache-iad-kjyo7100084-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 14 Aug 2023 22:20:29 GMT
server
nginx
x-timer
S1694888542.790232,VS0,VE0
etag
"335526c839a0a07411d8bd60a000e03d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 17, 1, 73, 3575
69eb529db3a684fd0c871bccb855e899.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
84 KB
85 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/69eb529db3a684fd0c871bccb855e899.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a576a611858274b01aeb1c6beddc745964205e3a5d955088c8c5163dc0d654a2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/69eb529db3a684fd0c871bccb855e899.jpg
age
1408046
edge-cache-tag
546102629353737717267587571376253491136,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
546102629353737717267587571376253491136,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, MISS, HIT
x-envoy-upstream-service-time
538
req-referer
https://cdn.taboola.com/
content-length
86370
x-request-id
13977f6f0544b77732eb97d4cc307062
x-backend-name
CH_nlb804
x-served-by
cache-iad-kiad7000136-IAD, cache-iad-kjyo7100068-IAD, cache-iad-kiad7000031-IAD, cache-fra-eddf8230109-FRA
last-modified
Wed, 30 Aug 2023 05:40:11 GMT
server
nginx
x-timer
S1694888542.793926,VS0,VE0
etag
"dbb441c2644d9a4ffd618c406ff434cf"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 0, 2
OnPaste.20230829-024133.jpg%3Fw%3D1024%26h%3D619
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/
28 KB
29 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/OnPaste.20230829-024133.jpg%3Fw%3D1024%26h%3D619
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f39747a909c8b87831f585d5930385facbbecdc9badbd18c464195c4272b8d59

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/08/OnPaste.20230829-024133.jpg%3Fw%3D1024%26h%3D619
age
1538489
edge-cache-tag
354467468990702733280249495686103970213,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
354467468990702733280249495686103970213,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
673
req-referer
https://www.mercurynews.com/
content-length
28428
x-request-id
a072d1299a036ee39bcc64baea621214
x-backend-name
CH_nlb804
x-served-by
cache-iad-kcgs7200173-IAD, cache-iad-kjyo7100065-IAD, cache-iad-kjyo7100179-IAD, cache-fra-eddf8230109-FRA
last-modified
Tue, 29 Aug 2023 23:00:52 GMT
server
nginx
x-timer
S1694888542.796844,VS0,VE0
etag
"1495749f6c309e03198ac8b4ffd9ad82"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 19, 2
musk4.jpg%3Fw%3D620%26h%3D418
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/
39 KB
40 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/musk4.jpg%3Fw%3D620%26h%3D418
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
36ff92531f15c249815b6b0b5ac0728419c25d626a3f54ff40111031b3ebf10f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_834%2Cw_1500%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/musk4.jpg%3Fw%3D620%26h%3D418
age
426008
edge-cache-tag
499267841495605413871576870007693807335,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
499267841495605413871576870007693807335,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
413
req-referer
https://www.mercurynews.com/
content-length
40352
x-request-id
ce2edccc0544e90d47b3efaa4e2e4a4c
x-backend-name
LA_nlb201
x-served-by
cache-iad-kiad7000097-IAD, cache-iad-kiad7000034-IAD, cache-sna10739-LGB, cache-iad-kjyo7100158-IAD, cache-fra-eddf8230109-FRA
last-modified
Mon, 11 Sep 2023 19:45:45 GMT
server
nginx
surrogate-reporting
width=620,height=344,owidth=620,oheight=418,obytes=158343
x-timer
S1694888542.798136,VS0,VE0
etag
"7ad9bd8dd7b7339ff907e7ae1bbc3c5e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 58, 2
feed-card-placeholder.20230913-6-RELEASE.es6.js
cdn.taboola.com/libtrc/
5 KB
2 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/feed-card-placeholder.20230913-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f1ffaa351819f5d0479c92f25bd7143322acbb19e00aaea292571abd25d82ae1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
tra.5QWZeG6Ua2nvRiWW88emo83Oq7RH
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:21 GMT
x-amz-request-id
JP3VF192Z24F49PV
age
259961
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1262
x-amz-id-2
R5jd3KlqcfRmkQO+Q15WitsG0nozJJWf/Fi2mr8hsJwWqdNbcbO9xn/39TvjS0fvTXrJzFyhJk0=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 13 Sep 2023 18:09:40 GMT
server
AmazonS3
x-timer
S1694888542.845612,VS0,VE0
etag
"78619aab1ace42a8588e3ce3636be3c4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
95
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
397356
distance-from-article.20230913-6-RELEASE.es6.js
cdn.taboola.com/libtrc/
2 KB
1 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/distance-from-article.20230913-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9e6683f38016b2a2deeecde460d3a5829fe0e7d657f00e02cb3ec247c89a36c7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
MyFFu.MN7l85oJI2uCWwynRtjJsAAPLK
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:21 GMT
x-amz-request-id
52DQ4CZPQ9JZA8K7
age
259966
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1132
x-amz-id-2
xFbIJx7Ga1+ggDOGKPQwb7qucUNJkIdBzscDbE3JtFkgLalfRwLeq/fyFa6CvzVtGOp9tMrT7B4=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 13 Sep 2023 18:09:36 GMT
server
AmazonS3
x-timer
S1694888542.847677,VS0,VE0
etag
"701fc3d562afff1d50de41b6cb5f29d3"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
5
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
428924
article-detection.20230913-6-RELEASE.es6.js
cdn.taboola.com/libtrc/
3 KB
2 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/article-detection.20230913-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c50fbc8b93d93020dcd019b9a9c035fef70c9338216b0fd85b02e8dfd1913f63

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
l.BZiDbCuPDNBs_71FhCuCTGi9HFBfP5
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:21 GMT
x-amz-request-id
WM1SJE86GQS6YBCZ
age
259973
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1291
x-amz-id-2
UsHdMYwCu/fIjWSG/FLTRakPxfV/xX+fXvsyvgcfuxoNdCK+qtpC905BPs+143JvdcO7vzoNz9U=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 13 Sep 2023 18:09:29 GMT
server
AmazonS3
x-timer
S1694888542.848862,VS0,VE0
etag
"d6e803678897aedb291df97b4c46a629"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
40
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
428758
userx.20230913-6-RELEASE.es6.js
cdn.taboola.com/libtrc/
17 KB
6 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/userx.20230913-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
42953d1747f4fe07f37cc5eff38e59f4cf1a4dce07b8e984d7151b8e13d95b15

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
voqysrCdqi7Bi6zwaAzLXrQpjfaF..wb
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:21 GMT
x-amz-request-id
G2GWZKC66N2HVFF2
age
259935
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
5397
x-amz-id-2
/rPi1+14EGT2s3kFPJs+ESgb9u3rfz8/vPqHpSZ6G9RrfeEovk2QYmtyNLXuCB84xkzUl1utDwc=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 13 Sep 2023 18:10:06 GMT
server
AmazonS3
x-timer
S1694888542.849744,VS0,VE0
etag
"b5a951e6956fea249e798b3542bba953"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
1
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
81489
explore-more.20230913-6-RELEASE.es6.js
cdn.taboola.com/libtrc/
30 KB
9 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/explore-more.20230913-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4c5569ecbfb0d31b21c3956bd9775fd78d3b995746cea583067f7b20fdedf0b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
j31BHl28FzQQx3xH7hab6j_Jel5BYjv7
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:21 GMT
x-amz-request-id
0WX7G9EYK9P0EDNV
age
259963
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
8803
x-amz-id-2
QwGzEOZdXe8zhBeAkv5/Rp+pWd4NorizzEYZawrprcWTm8syaMSyj4L2Dozz5JIS4jA4Iauz+Kg=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 13 Sep 2023 18:09:39 GMT
server
AmazonS3
x-timer
S1694888542.850599,VS0,VE0
etag
"0cd534b61f22e3fe72b6885cff516522"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
94
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
219531
bulk
trc.taboola.com/medianewsgroup-mercurynews/log/3/
0
309 B
XHR
General
Full URL
https://trc.taboola.com/medianewsgroup-mercurynews/log/3/bulk?tvi48=10637&tvi50=10582&route=AM%3AAM%3AV&lti=deflated&bulkSize=11
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

x-vcl-time-ms
11
date
Sat, 16 Sep 2023 18:22:21 GMT
via
1.1 varnish
x-fastly-to-nlb-rtt
7414
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v1
x-served-by
cache-fra-eddf8230109-FRA
pragma
no-cache
server
nginx
x-timer
S1694888542.871192,VS0,VE11
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
oWC56BsJpta4Z6cWzn4BJ9TuSwCyxCXc.png
k3vzn.flx10.com/ Frame AA29
5 KB
5 KB
Image
General
Full URL
https://k3vzn.flx10.com/oWC56BsJpta4Z6cWzn4BJ9TuSwCyxCXc.png?width=141&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds343.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
5071
HyLq97DsC1p593YSMVBwnzkVpltbDmRw.png
k3vzn.flx10.com/ Frame AA29
746 B
818 B
Image
General
Full URL
https://k3vzn.flx10.com/HyLq97DsC1p593YSMVBwnzkVpltbDmRw.png?width=56&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds287.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
746
EILNqZk4UjTPU9Qs7JSuBZAROWQrBCa7.png
k3vzn.flx10.com/ Frame AA29
641 B
712 B
Image
General
Full URL
https://k3vzn.flx10.com/EILNqZk4UjTPU9Qs7JSuBZAROWQrBCa7.png?width=68&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds016.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
641
lMwCPvWqBC5jQ9GewZLSELopZJyiXUcM.jpg
k3vzn.flx10.com/ Frame AA29
3 KB
3 KB
Image
General
Full URL
https://k3vzn.flx10.com/lMwCPvWqBC5jQ9GewZLSELopZJyiXUcM.jpg?width=143&height=50&focusX=92.5&focusY=0&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds124.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
3184
oWC56BsJpta4Z6cWzn4BJ9TuSwCyxCXc.png
k3vzn.flx10.com/ Frame 3702
7 KB
7 KB
Image
General
Full URL
https://k3vzn.flx10.com/oWC56BsJpta4Z6cWzn4BJ9TuSwCyxCXc.png?width=189&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds285.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
7045
HyLq97DsC1p593YSMVBwnzkVpltbDmRw.png
k3vzn.flx10.com/ Frame 3702
1 KB
1 KB
Image
General
Full URL
https://k3vzn.flx10.com/HyLq97DsC1p593YSMVBwnzkVpltbDmRw.png?width=100&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds142.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
1293
EILNqZk4UjTPU9Qs7JSuBZAROWQrBCa7.png
k3vzn.flx10.com/ Frame 3702
1 KB
1 KB
Image
General
Full URL
https://k3vzn.flx10.com/EILNqZk4UjTPU9Qs7JSuBZAROWQrBCa7.png?width=117&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds285.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
1047
lMwCPvWqBC5jQ9GewZLSELopZJyiXUcM.jpg
k3vzn.flx10.com/ Frame 3702
10 KB
10 KB
Image
General
Full URL
https://k3vzn.flx10.com/lMwCPvWqBC5jQ9GewZLSELopZJyiXUcM.jpg?width=313&height=90&focusX=86.26&focusY=0&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds216.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
10224
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 16 Sep 2023 17:44:21 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
2280
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Sat, 16 Sep 2023 19:44:21 GMT
supply-feature
am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/
0
230 B
Image
General
Full URL
https://am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/supply-feature?route=AM:AM:V&tvi48=10637&tvi50=10582&lti=deflated&ri=0857e9c2ac9fbd85a55321eb3013413d&sd=v2_b364651dfa3ac9e9d9b1be50c74a7db7_278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db_1694888539_1694888539_CNawjgYQtdRXGPLq6vmpMSABKAEwODib4wlAgooQSL--2QNQ____________AVgAYABo2ZPr9_We9LvCAXAA&ui=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1694888539506&d=%7B%22event_type%22%3A%22distance_from_article%22%2C%22event_state%22%3A%22reported%22%2C%22event_value%22%3A%22739.53125%22%2C%22event_msg%22%3A%22%22%2C%22event_key%22%3A%22%22%7D&tim=20%3A22%3A21.999&id=9879&llvl=2&cv=20230913-6-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:22 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
css2
fonts.googleapis.com/
20 KB
915 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a44f5d561cd3e602e092304c1356809a206492fa189be1c11d923e8e768b06b5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 16 Sep 2023 18:22:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 16 Sep 2023 17:38:28 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 16 Sep 2023 18:22:22 GMT
container.html
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F1DE
6 KB
3 KB
Document
General
Full URL
https://dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/explore-more.20230913-6-RELEASE.es6.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
5
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 16 Sep 2023 18:22:17 GMT
expires
Sun, 15 Sep 2024 18:22:17 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
supply-feature
am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/
0
230 B
Image
General
Full URL
https://am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/supply-feature?route=AM:AM:V&tvi48=10637&tvi50=10582&lti=deflated&ri=0857e9c2ac9fbd85a55321eb3013413d&sd=v2_b364651dfa3ac9e9d9b1be50c74a7db7_278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db_1694888539_1694888539_CNawjgYQtdRXGPLq6vmpMSABKAEwODib4wlAgooQSL--2QNQ____________AVgAYABo2ZPr9_We9LvCAXAA&ui=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1694888539506&d=%7B%22event_type%22%3A%22EXPLORE_MORE%22%2C%22event_state%22%3A%22AVAILABLE%22%2C%22event_value%22%3A%22%22%2C%22event_msg%22%3A%22%22%2C%22event_key%22%3A%22%22%7D&tim=20%3A22%3A22.014&id=3823&llvl=2&cv=20230913-6-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:22 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
abtests
am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/
0
230 B
Image
General
Full URL
https://am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=AM:AM:V&tvi48=10637&tvi50=10582&lti=deflated&ri=0857e9c2ac9fbd85a55321eb3013413d&sd=v2_b364651dfa3ac9e9d9b1be50c74a7db7_278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db_1694888539_1694888539_CNawjgYQtdRXGPLq6vmpMSABKAEwODib4wlAgooQSL--2QNQ____________AVgAYABo2ZPr9_We9LvCAXAA&ui=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1694888539506&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22explore-more%22%2C%22type%22%3A%22header%20found%22%2C%22eventTime%22%3A1694888542030%7D&tim=20%3A22%3A22.031&id=8965&llvl=2&cv=20230913-6-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:22 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
supply-feature
am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/
0
230 B
Image
General
Full URL
https://am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/supply-feature?route=AM:AM:V&tvi48=10637&tvi50=10582&lti=deflated&ri=0857e9c2ac9fbd85a55321eb3013413d&sd=v2_b364651dfa3ac9e9d9b1be50c74a7db7_278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db_1694888539_1694888539_CNawjgYQtdRXGPLq6vmpMSABKAEwODib4wlAgooQSL--2QNQ____________AVgAYABo2ZPr9_We9LvCAXAA&ui=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1694888539506&d=%7B%22event_type%22%3A%22EXPLORE_MORE%22%2C%22event_state%22%3A%22CLICKABLE%22%2C%22event_value%22%3A%22tblOriginalState%3A%20true%22%2C%22event_msg%22%3A%22back%20button%20enabled%2C%20history%20changed.%22%2C%22event_key%22%3A%22%22%7D&tim=20%3A22%3A22.034&id=4455&llvl=2&cv=20230913-6-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:22 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
mn-logo.svg
www.mercurynews.com/wp-content/uploads/2020/09/
12 KB
5 KB
Image
General
Full URL
https://www.mercurynews.com/wp-content/uploads/2020/09/mn-logo.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 23 Sep 2020 17:38:16 GMT
server
nginx
x-rq
hhn2 109 195 443
etag
W/"497950346404e2d1"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=31536000
abtests
am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/
0
230 B
Image
General
Full URL
https://am-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=AM:AM:V&tvi48=10637&tvi50=10582&lti=deflated&ri=0857e9c2ac9fbd85a55321eb3013413d&sd=v2_b364651dfa3ac9e9d9b1be50c74a7db7_278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db_1694888539_1694888539_CNawjgYQtdRXGPLq6vmpMSABKAEwODib4wlAgooQSL--2QNQ____________AVgAYABo2ZPr9_We9LvCAXAA&ui=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1694888539506&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22explore-more%22%2C%22type%22%3A%22explore-more-available%22%2C%22eventTime%22%3A1694888542050%7D&tim=20%3A22%3A22.051&id=3982&llvl=2&cv=20230913-6-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 16 Sep 2023 18:22:22 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
st
imprammp.taboola.com/ Frame 3D9A
0
0

sync
am-match.taboola.com/ Frame EBEC
422 B
516 B
Document
General
Full URL
https://am-match.taboola.com/sync?dast=V8aGYCLAaobr5060Z7yxFQ3Xzp1o32lisAAABgYID-AAlsJs7hyuZwa4y7mVu0ci7WypFzsJZNNjbDarabeSYOIyCBzcQ5XNkcbo1xN3OLVs7FWjlyDtayycZmWM12M8_EYQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awCA4oBQlrPD7nPZ_QEAAAAABAAAAAAJAISW5xIALyOZJ_7_________YwzQZ97I-P___79h0APgwQfAgxAAAICPISoSNUNKkJhXRApOizACAAAAEPVVwHJkkk5Qsajy___fbwXgCgBAgOKnTu1wFt1BibcwAAAABGMW6GHx-80Ou8bvdpn_________fzP_Z_7RCBlxpaQJggEAUPMLCACw5hcQAICNugEAeBMAJ-gQtGIwWJ2AmB0AAACAO_____96QMQzG81Wi5HN4Vl4nCvnyDlxTFyuwcY3WvhGFt_2JFUdUyKRd3f2CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYrEboIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBCO74cKyMi7cIpPJ4haNRsa1cuXarEUe33Az8owmM-NkLXp9TBebzbcbWbxIMGBxL5KnRToRDFe7lXNjWXicM4vJuFq4VpvJYmXxDBab0WIzsoglmpNFOpFd9hXPbDRbLUY2h2fhca6cI-fEMXG5BhvfaOEbWXz7ym64sKyMC7fIZLK4RaORca1cuTZrkcc33Iw8o8nMOFmLXh_TxWbz7UYWf2O2HA2Hw9VmuW_MlqPhcLjaLPcdOsN39TkbpZOl2COUGbfZ2_DmNChcBov3JzEtpt3ZwfP7HZ0yWy1Z1Bn9fr_f7_f7_X6_36D1HMwGhW-ZFirPfa_lHNM-DGKDQRFLBBfpRO0yOR12l-_zs_xdh7faZfm4Ls-7y_e5iCVK00U60UsGk81eMNtLBnu1y2d02N1qh-VrdrlVDsvdZXKr_ZaXW3R02N2io8ute7m8dpNb5re8pa7P6a2YrIV-1-Xz1v0tX7fK-NYc_qanzflWGV8et-hlNnveEovHIpYIThfpRPQyni7qP1LAxVy5mqvmotEqAQAAAAAAAABYgmmmmwAAAAA4GdRmNlis1ulgBsPlZrBaLoAK9RpdP27a779Ukty76qsuGrc9veCLNfaYRrtMTofd5fv8LH_X4a12WT6uy_Pu8n2uDKAi_YfZZp8RxFqtljUAAAABbAAAAAHcdONNQJgV9____z8OAAAggBx6AAAA9PuAoMj1wo9cKfgVxGA1nOwfgAqxVqvV7cZarVZAAlntlhP4____Dw!&excid=22&docw=0&cijs=1&nlb=false
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-type
text/html;charset=ISO-8859-1
date
Sat, 16 Sep 2023 18:22:22 GMT
machineid
3407
server
nginx
st
am-vid-events.taboola.com/
0
0

3391
config.aps.amazon-adsystem.com/configs/
505 B
769 B
Script
General
Full URL
https://config.aps.amazon-adsystem.com/configs/3391
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-128.fra6.r.cloudfront.net
Software
CloudFront /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 17:55:11 GMT
via
1.1 a0a81637cc76d6981e4e29044a73b7f6.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
FRA6-C1
age
1631
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=3600
content-length
505
x-amz-cf-id
anNq8L_75OMW1GIvCW2pyBUQi09rN_J2TK1Pm0T1n60-1TjmFS7k8Q==
config
c.amazon-adsystem.com/cdn/prod/
337 B
697 B
XHR
General
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=3391&u=https%3A%2F%2Fwww.mercurynews.com
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.110.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-110-17.fra56.r.cloudfront.net
Software
Server /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 12:30:38 GMT
via
1.1 91dc0292eef4e22508a3ae73fe64bbf4.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA56-P5
age
21104
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
content-length
337
x-amz-cf-id
WJOnXuaOJQJh0cizRV7-1qrJOnPZIiVnVb_yN2X1pHMF4lty7YGlSQ==
bid
aax.amazon-adsystem.com/e/dtb/
23 B
463 B
XHR
General
Full URL
https://aax.amazon-adsystem.com/e/dtb/bid?src=3391&u=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&pid=d92rJOY1CW7Z8&cb=1&ws=1600x1200&v=23.829.1852&t=2000&slots=%5B%7B%22sd%22%3A%22htlad-1-gpt%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%5D&cfgv=1&gpp=DBACOe~~~&gpp_sid=%5B2%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.138.185 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-138-185.fra60.r.cloudfront.net
Software
Server /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
strict-transport-security
max-age=47474747; includeSubDomains; preload
via
1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA60-P4
x-amz-rid
DQH4SQM6Q7DKGK2T9ZAP
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
0UCTLc2lijVI_TOsGX_2AJfghRVy3pSW053wjlOxe3fuRqc2gZi9bQ==
251918c4-dd7d-4ef3-b7fa-10e4356a15f1
https://www.mercurynews.com/
390 B
0
Other
General
Full URL
blob:https://www.mercurynews.com/251918c4-dd7d-4ef3-b7fa-10e4356a15f1
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
oWC56BsJpta4Z6cWzn4BJ9TuSwCyxCXc.png
k3vzn.flx10.com/ Frame AA29
5 KB
5 KB
Image
General
Full URL
https://k3vzn.flx10.com/oWC56BsJpta4Z6cWzn4BJ9TuSwCyxCXc.png?width=141&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds343.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
5071
HyLq97DsC1p593YSMVBwnzkVpltbDmRw.png
k3vzn.flx10.com/ Frame AA29
746 B
790 B
Image
General
Full URL
https://k3vzn.flx10.com/HyLq97DsC1p593YSMVBwnzkVpltbDmRw.png?width=56&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds287.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
746
EILNqZk4UjTPU9Qs7JSuBZAROWQrBCa7.png
k3vzn.flx10.com/ Frame AA29
641 B
676 B
Image
General
Full URL
https://k3vzn.flx10.com/EILNqZk4UjTPU9Qs7JSuBZAROWQrBCa7.png?width=68&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds016.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
641
lMwCPvWqBC5jQ9GewZLSELopZJyiXUcM.jpg
k3vzn.flx10.com/ Frame AA29
3 KB
3 KB
Image
General
Full URL
https://k3vzn.flx10.com/lMwCPvWqBC5jQ9GewZLSELopZJyiXUcM.jpg?width=143&height=50&focusX=92.5&focusY=0&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds124.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
3184
oWC56BsJpta4Z6cWzn4BJ9TuSwCyxCXc.png
k3vzn.flx10.com/ Frame 3702
7 KB
7 KB
Image
General
Full URL
https://k3vzn.flx10.com/oWC56BsJpta4Z6cWzn4BJ9TuSwCyxCXc.png?width=189&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds285.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
7045
HyLq97DsC1p593YSMVBwnzkVpltbDmRw.png
k3vzn.flx10.com/ Frame 3702
1 KB
1 KB
Image
General
Full URL
https://k3vzn.flx10.com/HyLq97DsC1p593YSMVBwnzkVpltbDmRw.png?width=100&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds142.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
1293
EILNqZk4UjTPU9Qs7JSuBZAROWQrBCa7.png
k3vzn.flx10.com/ Frame 3702
1 KB
1 KB
Image
General
Full URL
https://k3vzn.flx10.com/EILNqZk4UjTPU9Qs7JSuBZAROWQrBCa7.png?width=117&focusX=50&focusY=50&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds285.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
1047
lMwCPvWqBC5jQ9GewZLSELopZJyiXUcM.jpg
k3vzn.flx10.com/ Frame 3702
10 KB
10 KB
Image
General
Full URL
https://k3vzn.flx10.com/lMwCPvWqBC5jQ9GewZLSELopZJyiXUcM.jpg?width=313&height=90&focusX=86.26&focusY=0&zoom=100
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tj6w5.flx10.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
server
nginx
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
x-hw
1694888542.cds252.fr8.hn,1694888542.cds216.fr8.c
cache-control
public, max-age=864000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, X-Auth-Token
content-length
10224
ads
securepubads.g.doubleclick.net/gampad/
30 KB
13 KB
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2858320542504758&correlator=3761584316962135&eid=31077941%2C31077885%2C31068366%2C44800855&output=ldjh&gdfp_req=1&vrg=202309120101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=6&sfv=1-0-40&rcs=1&eri=1&sc=1&abxe=1&dt=1694888542261&lmt=1694881342&adxs=3075&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vis=1&psz=320x50&msz=320x50&fws=3076&ohw=1254&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnoXCDEr1sW_A09WYk2AROs_6NepLq1izjTIUkeG4DPlCyuDdCAFHDaP7p0hkEq4DFjYlmQhSfJBpQwfYtZeYrKPQ%2CAOrYGslHDOBz323aB-5aCg5WFvpIW9TOQwQTo-JxhT7_fSXLP9fkxAZxNoiIartgaBek6tSklSXKqx2bsYLmEw4iduIIgQ%2CAOrYGslfRyWXdbAwb3c2pgp3HnM4gm1xx2HPJ7IUjs89_nbw7HO63uvpOLC2B4MHJExcXBfQaxsDkBl4MTq6EjUZB9bzbRspXaLB&ga_vid=845503735.1694888535&ga_sid=1694888538&ga_hid=1003104940&ga_fc=true&dlt=1694888532546&idt=2001&prev_scp=pos%3DSponsorship_1%26htl_refresh%3D1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D395395726776%26rurl%3D%26articleid%3D9968021&adks=1140109686&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309120101/pubads_impl.js?cb=31077885
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 18:22:22 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13194
x-xss-protection
0
google-lineitem-id
6257180320
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138430892413
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
cds-pips.js
cdn.taboola.com/scripts/
3 KB
2 KB
Script
General
Full URL
https://cdn.taboola.com/scripts/cds-pips.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
z5FoayaLm_Bvew3pbkytkoHczFCvkPwT
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:22 GMT
x-amz-request-id
1V3JN4Z08BWJNCK3
age
2118
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
1340
x-amz-id-2
yvDfBoaedLRfPwP0+zgbFCFLRwR4EiC1X5itZ+rLiciBisyuBdOMxzu1/H2ZTO40ir0cZXkf7JA=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 12 Oct 2022 13:57:57 GMT
server
AmazonS3
x-timer
S1694888542.284918,VS0,VE0
etag
"383fa66d2a0a09f4a6e64a9593ad43bb"
vary
Accept-Encoding
content-type
application/javascript
abp
10
access-control-allow-origin
*
cache-control
private, max-age=3600
accept-ranges
bytes
x-cache-hits
13464
generic
match.adsrvr.org/track/cmf/ Frame EBEC
0
0

278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db
pr-bh.ybp.yahoo.com/sync/taboola/ Frame EBEC
0
0

sync
x.bidswitch.net/ Frame EBEC
0
0

/
pips.taboola.com/
4 B
144 B
XHR
General
Full URL
https://pips.taboola.com/
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 -, , ASN (),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-served-by
cache-fra-etou8220105-FRA
date
Sat, 16 Sep 2023 18:22:22 GMT
via
1.1 varnish
server
Varnish
access-control-allow-methods
GET
x-cache
HIT
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-store
accept-ranges
bytes
content-length
4
retry-after
0
x-cache-hits
0
spa-detector.20230913-6-RELEASE.es6.js
cdn.taboola.com/libtrc/
2 KB
1 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/spa-detector.20230913-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

x-amz-version-id
YHibI6jwJZt4sMDKMO2HyZ3KJps3qMqx
content-encoding
gzip
via
1.1 varnish
date
Sat, 16 Sep 2023 18:22:22 GMT
x-amz-request-id
JWPCQR5V72CKGJWS
age
259948
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
779
x-amz-id-2
CpSLQgPcfManjnQajUDV+fO3jTypoWGDnRmbLV1LM0+ACakYKFdgqg9WShCo2KxFiofNkaLXbgY=
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Wed, 13 Sep 2023 18:09:55 GMT
server
AmazonS3
x-timer
S1694888542.395852,VS0,VE0
etag
"df63c30fa9e001fde13aa63cccae1704"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
55
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
222483
/
cds.taboola.com/
0
0

activeview
pagead2.googlesyndication.com/pcs/ Frame CBD4
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
imprammp.taboola.com
URL
https://imprammp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8aGYCLAaobr5060Z7yxFQ3Xzp1o32lisAAABgYID-AAlsJs7hyuZwa4y7mVu0ci7WypFzsJZNNjbDarabeSYOIyCBzcQ5XNkcbo1xN3OLVs7FWjlyDtayycZmWM12M8_EYQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awCA4oBQlrPD7nPZ_QEAAAAABAAAAAAJAISW5xIALyOZJ_7_________YwzQZ97I-P___79h0APgwQfAgxAAAICPISoSNUNKkJhXRApOizACAAAAEPVVwHJkkk5Qsajy___fbwXgCgBAgOKnTu1wFt1BibcwAAAABGMW6GHx-80Ou8bvdpn_________fzP_Z_7RCBlxpaQJggEAUPMLCACw5hcQAICNugEAeBMAJ-gQtGIwWJ2AmB0AAACAO_____96QMQzG81Wi5HN4Vl4nCvnyDlxTFyuwcY3WvhGFt_2JFUdUyKRd3f2CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYrEboIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBCO74cKyMi7cIpPJ4haNRsa1cuXarEUe33Az8owmM-NkLXp9TBebzbcbWbxIMGBxL5KnRToRDFe7lXNjWXicM4vJuFq4VpvJYmXxDBab0WIzsoglmpNFOpFd9hXPbDRbLUY2h2fhca6cI-fEMXG5BhvfaOEbWXz7ym64sKyMC7fIZLK4RaORca1cuTZrkcc33Iw8o8nMOFmLXh_TxWbz7UYWf2O2HA2Hw9VmuW_MlqPhcLjaLPcdOsN39TkbpZOl2COUGbfZ2_DmNChcBov3JzEtpt3ZwfP7HZ0yWy1Z1Bn9fr_f7_f7_X6_36D1HMwGhW-ZFirPfa_lHNM-DGKDQRFLBBfpRO0yOR12l-_zs_xdh7faZfm4Ls-7y_e5iCVK00U60UsGk81eMNtLBnu1y2d02N1qh-VrdrlVDsvdZXKr_ZaXW3R02N2io8ute7m8dpNb5re8pa7P6a2YrIV-1-Xz1v0tX7fK-NYc_qanzflWGV8et-hlNnveEovHIpYIThfpRPQyni7qP1LAxVy5mqvmotEqAQAAAAAAAABYgmmmmwAAAAA4GdRmNlis1ulgBsPlZrBaLoAK9RpdP27a779Ukty76qsuGrc9veCLNfaYRrtMTofd5fv8LH_X4a12WT6uy_Pu8n2uDKAi_YfZZp8RxFqtljUAAAABbAAAAAHcdONNQJgV9____z8OAAAggBx6AAAA9PuAoMj1wo9cKfgVxGA1nOwfgAqxVqvV7cZarVZAAlntlhP4____Dw!&cmcv=&pix=undefined&cb=1694888542095&uv=3340&tms=1694888542095&abt=nonrv_vA!rv0lcr_vA!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=03b98efa-c87f-4e91-9d90-62cf0567f3ba&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Domain
am-vid-events.taboola.com
URL
https://am-vid-events.taboola.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=66361655&crid=-1&dast=V8aGYCLAaobr5060Z7yxFQ3Xzp1o32lisAAABgYID-AAlsJs7hyuZwa4y7mVu0ci7WypFzsJZNNjbDarabeSYOIyCBzcQ5XNkcbo1xN3OLVs7FWjlyDtayycZmWM12M8_EYQUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awCA4oBQlrPD7nPZ_QEAAAAABAAAAAAJAISW5xIALyOZJ_7_________YwzQZ97I-P___79h0APgwQfAgxAAAICPISoSNUNKkJhXRApOizACAAAAEPVVwHJkkk5Qsajy___fbwXgCgBAgOKnTu1wFt1BibcwAAAABGMW6GHx-80Ou8bvdpn_________fzP_Z_7RCBlxpaQJggEAUPMLCACw5hcQAICNugEAeBMAJ-gQtGIwWJ2AmB0AAACAO_____96QMQzG81Wi5HN4Vl4nCvnyDlxTFyuwcY3WvhGFt_2JFUdUyKRd3f2CRGW2e87KCinp8fsMoiKrrfF7nCaPQfxQcOwnAyC-ZmwxWg1mWyWw9lyMRkMR8PRaH8GYrEboIkYLJeTyWKyW41Wo81wN5oNFkggBhNE0aLBZDUaTRaT4Wo0Wc2Wi91ugyhatZqNNoPhajaZ7Xar4WC4HI3QhC1Gq8lksxzOlovJYDgajkZDBCO74cKyMi7cIpPJ4haNRsa1cuXarEUe33Az8owmM-NkLXp9TBebzbcbWbxIMGBxL5KnRToRDFe7lXNjWXicM4vJuFq4VpvJYmXxDBab0WIzsoglmpNFOpFd9hXPbDRbLUY2h2fhca6cI-fEMXG5BhvfaOEbWXz7ym64sKyMC7fIZLK4RaORca1cuTZrkcc33Iw8o8nMOFmLXh_TxWbz7UYWf2O2HA2Hw9VmuW_MlqPhcLjaLPcdOsN39TkbpZOl2COUGbfZ2_DmNChcBov3JzEtpt3ZwfP7HZ0yWy1Z1Bn9fr_f7_f7_X6_36D1HMwGhW-ZFirPfa_lHNM-DGKDQRFLBBfpRO0yOR12l-_zs_xdh7faZfm4Ls-7y_e5iCVK00U60UsGk81eMNtLBnu1y2d02N1qh-VrdrlVDsvdZXKr_ZaXW3R02N2io8ute7m8dpNb5re8pa7P6a2YrIV-1-Xz1v0tX7fK-NYc_qanzflWGV8et-hlNnveEovHIpYIThfpRPQyni7qP1LAxVy5mqvmotEqAQAAAAAAAABYgmmmmwAAAAA4GdRmNlis1ulgBsPlZrBaLoAK9RpdP27a779Ukty76qsuGrc9veCLNfaYRrtMTofd5fv8LH_X4a12WT6uy_Pu8n2uDKAi_YfZZp8RxFqtljUAAAABbAAAAAHcdONNQJgV9____z8OAAAggBx6AAAA9PuAoMj1wo9cKfgVxGA1nOwfgAqxVqvV7cZarVZAAlntlhP4____Dw!&cmcv=&pix=31589837&cb=1694888542095&uv=3340&tms=1694888542095&abt=nonrv_vA!rv0lcr_vA!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&debug=pn:!sqg:!torgn:1694888532199.9!ts:1694888542095&mntl=1
Domain
match.adsrvr.org
URL
https://match.adsrvr.org/track/cmf/generic?gdpr=1&ttd_pid=054f32o&us_privacy=1---&ttd_tpi=1
Domain
pr-bh.ybp.yahoo.com
URL
https://pr-bh.ybp.yahoo.com/sync/taboola/278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db?gdpr=1&us_privacy=1---
Domain
x.bidswitch.net
URL
https://x.bidswitch.net/sync?gdpr=1&us_privacy=1---&ssp=taboola
Domain
cds.taboola.com
URL
https://cds.taboola.com/?uid=278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db&mbl=ZmFsc2U=
Domain
pagead2.googlesyndication.com
URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvSLFXRyZVrmE2Lt8X_5DuxnogN0zd25Lr7UMoHRmcMX7rqsda7lRJiRNpQufOMoXE8G2XHFOAfXVj1rlzI-VJnh60-ccCOn5MIu1AKZ3nUq_kHXL_hiE-JqIAQpZoR&sig=Cg0ArKJSzAEbnsljsP7YEAE&id=lidartos&mcvt=0&p=79,3075,129,3395&mtos=0,0,0,0,0&tos=0,0,0,0,0&v=20230913&bin=7&avms=nio&bs=0,0&mc=0&if=1&vu=1&app=0&itpl=19&adk=1140109686&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=3&r=b&rst=1694888537999&rpt=2193&isd=0&lsd=0&ec=1&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Verdicts & Comments Add Verdict or Comment

333 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| documentPictureInPicture object| scriptHelpers function| loadCSS object| _wpemojiSettings function| Osano function| __uspapi object| htlbid object| MNG_SSO_CONNEXT_EVENT_TIMING_ANALYTICS number| MNG_SSO_TOOLS_GLOBAL_START_TIME function| $ function| jQuery object| MG2 function| PluginInitOverride object| MG2Loader string| loaderVersion string| loaderBuild object| appInsights object| deferredResources function| blmGetIcon object| google object| module$exports$mapsapi$geometry$spherical object| reactiveElementVersions object| module$contents$mapsapi$overlay$overlayView_OverlayView function| createAuth0Client function| Auth0Client object| default_gsi object| authentication_config object| entitlements_config object| regeneratorRuntime function| simpleEmailValidation function| validatePhoneNumber object| MNGAuthentication boolean| disableAuth0AuthFlow function| backToStory object| PushlySDK object| dfm_pushly_options object| blueConicPreListeners function| BCClass object| blueConicClient object| dataLayer function| mg2WidgetAPI object| DFM_AD_MODS_LEVEL object| DFM_AD_MODS_DEBUG object| article_config object| _taboola function| analyticsEvent function| analyticsSocial function| analyticsVPV function| analyticsClearVPV function| analyticsForm function| closeMobileAdhesionAd function| keyboardHandler object| bloom_meta string| bloom_domain function| blmInit function| blmKeyUp function| blmTrigger function| blmMapLaunch function| blmMapClose function| blmGetMetadata object| bloom_nns boolean| bloom_nns_cookies_enabled object| bloom_nns_remote number| bloom_nns_remote_delay number| bloom_nns_iv_pulse boolean| bloom_amp function| blmSearchInit function| blmSearchLoad function| blmSearchLaunch function| blmSearchInitWindow function| blmSearchIconAction function| blmSearchKeyUp function| blmSearchOpen function| blmSearchClose function| blmSearchGeolocation function| blmSearchGeolocationResponse function| blmSearchLoadRemoteContent function| blmSearchSetLayout function| blmSearchGetLayout function| blmSearchUrlRequest function| blmSearchUrlParamParse function| blmSearchUrlParamModify function| blmSearchSupports function| blmSearchGetUserDistance function| blmSearchSetCookie function| blmSearchGetCookie function| blmSearchDeleteCookie object| runtime object| picturefillCFG function| picturefill object| lazySizesConfig object| lazySizes object| wp object| wpParselyHooks object| PARSELY boolean| dfmCanRunAds object| webpackChunkknowlton function| Headroom function| Hammer object| _stq object| AI object| Microsoft function| __extends function| _endsWith object| litHtmlVersions function| st_go function| linktracker_init object| wpcom object| closure_lm_16312 object| bloom_nns_el_button_current object| bloom_nns_el_button_current_label object| bloom_nns_el_header object| bloom_nns_el_header_title object| bloom_nns_el_header_landscape object| bloom_nns_el_header_landscape_balls object| bloom_nns_el_header_landscape_ball object| bloom_nns_el_content object| bloom_nns_el_content_local object| bloom_nns_el_content_local_banner object| bloom_nns_el_content_local_banner_text object| bloom_nns_el_content_local_banner_close object| bloom_nns_el_content_remote object| bloom_nns_el_content_local_intro object| bloom_nns_el_content_local_intro_title object| bloom_nns_el_content_local_intro_options object| bloom_nns_el_content_local_intro_options_button object| bloom_nns_el_content_local_intro_options_search object| bloom_nns_el_content_local_intro_options_search_input object| bloom_nns_el_content_local_intro_options_search_button object| bloom_nns_el_footer object| bloom_nns_el_footer_attribution object| bloom_nns_el_footer_arrow object| bloom_nns_el_footer_arrow_inner object| webVitals boolean| htlbidLoaded object| pbjsChunk object| pbjs object| _pbjsGlobals function| HTLBIDLoader object| googletag object| apstag object| twemoji function| _typeof object| TRC object| _tblConsole string| pm_pgtp undefined| msg object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data object| __G_ID_CLIENT__ string| GoogleAnalyticsObject function| ga string| comscoreID object| _qevents string| ssaUrl object| elem string| otId function| OptanonWrapper object| bc_json904 object| bc_json903 object| ggeac object| google_js_reporting_queue object| _aps boolean| apstagLOADED object| OneTrustStub function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcWarnUsingBeacon function| __trcDOMWalker function| __trcJSONify function| __trcUnJSONify function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam number| trc_debug_level string| trc_article_id object| TRCImpl object| confiant object| launchPad object| launchPadConfiguration object| nodeScript function| __launchpad function| gtag object| GooglebQhCsO object| _rmxd undefined| google_measure_js_timing object| apscustom boolean| htlbidStarted string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData boolean| creativeVendorLibraryLoaded boolean| _tb_dis string| pm_ppy string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv object| _pma undefined| _tb_d undefined| _tb_rand object| _pm_ecd function| _pmloadfile function| pmws_request_done function| _tb_getUrlParameter function| bt_eval function| bt_parameter function| bt_meta function| bt_cookie function| bt_data function| bt_log function| bt_handle_exception undefined| _bt_url_prefix undefined| _bt_referrer undefined| _bt_site undefined| _bt_mode function| btServe function| bt_data_escaped object| BrightTag object| gaplugins object| gaGlobal object| gaData object| LoaderConfig function| onYouTubeIframeAPIReady string| fpVersion string| fpBuild object| DeviceDetector object| Fingerprint object| g2ExtendInits object| G2Analytics object| G2Insights object| MG2Insights object| webpackJsonpnxtBundle object| NxtInner object| Connext object| CnnXt object| MG2DL function| TBVideoElem function| TBVideoEvents function| TBOptimizationAutoPlayInfoFromXPathAndURL object| _pmk function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBVideo function| TBVideoDetectionYoutubeAPI function| TBOptimizationTouchAndClickEventTracker function| TBWidgetStorage object| PMFileLoader object| PMPage object| PMTemplate function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| PMGlobal function| pmws_getlocation_done object| pmdebug object| pmws object| ji object| _pm_mcg function| InteractionTypeImpl object| Optanon object| OneTrust function| _____WB$wombat$assign$function_____ function| __WB_pmw object| gPartners object| _bcp object| Mustache function| BlueConicMetaDataService function| RuleService object| bc object| justDetectAdblock function| jwt_decode function| BlueConicEngagement function| md5 object| bcConnectionUtil function| BlueConicDataLayerUtility function| fbq function| _fbq undefined| tracker object| bc_json906 object| bc_json905 function| setImmediate function| clearImmediate object| bc_json907 object| tbopt number| google_unique_id object| GoogleGcLKhOms function| confiantDfpWrap object| google_image_requests object| _matherq number| taboola_view_id string| nam object| placementData

21 Cookies

Domain/Path Name / Value
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ Name: bloom_page_location_address
Value:
a869.mercurynews.com/DG/DEFAULT Name: BCSessionID
Value: ef1187b5-7391-4165-bddf-8d57d0d35477
digitalfirstmedia.blueconic.net/DG/DEFAULT Name: BCSessionID
Value: ef1187b5-7391-4165-bddf-8d57d0d35477
.mercurynews.com/ Name: bc_tstgrp
Value: 5
.mercurynews.com/ Name: _pnvl
Value: false
.mercurynews.com/ Name: pushly.user_puuid
Value: AoP4B2EUGFhuTAzsrPR1BWHbxyUvZf6f
.mercurynews.com/ Name: _gcl_au
Value: 1.1.1332369501.1694888534
.doubleclick.net/ Name: IDE
Value: AHWqTUkZ9t_CiW1Z3euCQJcXjVBJ2Y7DW9unU9hV_zQm-X5Dx_b6kzSoQP6r8VHj
.mercurynews.com/ Name: nxt_last_visit
Value: 1694888535067
.mercurynews.com/ Name: _ga_LMTT1ZNHB1
Value: GS1.1.1694888534.1.0.1694888535.0.0.0
.mercurynews.com/ Name: anonDeviceId
Value: c98ab204fd52cb53486764d7209082a7
digitalfirstmedia.blueconic.net/ Name: AWSALBCORS
Value: g9bXIKgKXEVcZxQZ3gpKGsYoWID1QS8dT3b2hHz5I2JBG4oUZ3Ndo/IN4M01IKimpkSZCVZrl1ire9PzV9+AJdG5c7ovIGDYAHj8hYbIN1OV+f7QaaKkWiTnFCAV
a869.mercurynews.com/ Name: AWSALB
Value: 8+8n8PLkCUATtVy8SGgNO8J+WEpfaQUNVsCYti/7Ima934P5n1ysxxaX1KVvmFX/r96c8nAE+jE4OQIz/xcJLxAwvWjxVdtA70NgT29RB6UOpJY12YCUAwQiWyHV
a869.mercurynews.com/ Name: AWSALBCORS
Value: 8+8n8PLkCUATtVy8SGgNO8J+WEpfaQUNVsCYti/7Ima934P5n1ysxxaX1KVvmFX/r96c8nAE+jE4OQIz/xcJLxAwvWjxVdtA70NgT29RB6UOpJY12YCUAwQiWyHV
.adnxs.com/ Name: uuid2
Value: 9043395552566649629
.mercurynews.com/ Name: _pnlspid
Value: 10402
.mercurynews.com/ Name: _pnss
Value: dismissed
.mercurynews.com/ Name: _pnpdm
Value: true
.www.mercurynews.com/ Name: sub_nxt_DFM_BANGWPPRODWAB_PROD
Value: {}
.www.mercurynews.com/ Name: sub_nxt_upd_ac_DFM_BANGWPPRODWAB_PROD
Value: 1
www.mercurynews.com/ Name: trc_cookie_storage
Value: taboola%2520global%253Auser-id%3D278a2e8a-dddb-44d8-9e53-dc783d342f82-tuctbff77db

5 Console Messages

Source Level URL
Text
network error URL: https://www.foo.software/api/vitals
Message:
Failed to load resource: the server responded with a status of 422 ()
network error URL: https://di.rlcdn.com/406006.gif?pdata=partner%3Dtap486987%2Cdata%3Dtype%3Asite%24audience%3AMSO_MercuryNews_ClientSite_Control
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://www.foo.software/api/vitals
Message:
Failed to load resource: the server responded with a status of 422 ()
other warning URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Message:
Origin trial controlled feature not enabled: 'attribution-reporting'.
other warning URL: https://tj6w5.flx10.com/libs/launcher-1.0.0.js
Message:
Allow attribute will take precedence over 'allowfullscreen'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

13619678.fls.doubleclick.net
a.teads.tv
a869.mercurynews.com
aax.amazon-adsystem.com
accounts.google.com
adservice.google.com
adservice.google.de
ajax.googleapis.com
am-match.taboola.com
am-trc-events.taboola.com
am-vid-events.taboola.com
ams-pageview-public.s3.amazonaws.com
api-mg2.db-ip.com
az416426.vo.msecnd.net
c.amazon-adsystem.com
cdn.auth0.com
cdn.confiant-integrations.net
cdn.cookielaw.org
cdn.czx5eyk0exbhwp43ya.biz
cdn.jsdelivr.net
cdn.jwplayer.com
cdn.p-n.io
cdn.parsely.com
cdn.pranmcpkx.com
cdn.taboola.com
cdn01.basis.net
cdn2.teads.tv
cds.taboola.com
cmp.osano.com
config.aps.amazon-adsystem.com
dc.services.visualstudio.com
dd3cc07813933069a557df06ce7683f8.safeframe.googlesyndication.com
di.rlcdn.com
digitalfirstmedia.blueconic.net
fonts.googleapis.com
fonts.gstatic.com
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
geo.privacymanager.io
geolocation.onetrust.com
googleads.g.doubleclick.net
gum.criteo.com
htlbid.com
images.taboola.com
imprammp.taboola.com
js.matheranalytics.com
js.moatads.com
k.p-n.io
k3vzn.flx10.com
launchpad-wrapper.privacymanager.io
launchpad.privacymanager.io
loader-cdn.azureedge.net
m.exactag.com
maps.googleapis.com
match.adsrvr.org
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
pips.taboola.com
pixel.sitescout.com
pixel.wp.com
player-files.remixd.com
pm-widget.taboola.com
polyfill.io
pr-bh.ybp.yahoo.com
prod-dfm-proxy-connext.azurewebsites.net
prodmg2.blob.core.windows.net
protected-by.clarium.io
pubcast-files.remixd.com
s.btstatic.com
s.thebrighttag.com
sb.scorecardresearch.com
secure.adnxs.com
securepubads.g.doubleclick.net
session.mercurynews.com
stats.wp.com
sync.teads.tv
t.teads.tv
tags.remixd.com
tj6w5.flx10.com
tpc.googlesyndication.com
tqe36.flx10.com
trc-events.taboola.com
trc.taboola.com
unpkg.com
vidstat.taboola.com
www.foo.software
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.i.matheranalytics.com
www.mercurynews.com
x.bidswitch.net
am-vid-events.taboola.com
cds.taboola.com
imprammp.taboola.com
match.adsrvr.org
pagead2.googlesyndication.com
pr-bh.ybp.yahoo.com
x.bidswitch.net
107.178.250.234
13.32.27.92
13.32.99.120
13.32.99.122
13.85.16.224
137.184.240.117
141.226.228.48
142.250.186.38
143.204.215.73
151.101.1.44
151.101.129.44
151.139.128.10
172.67.75.166
18.192.162.218
18.221.230.31
18.66.100.58
18.66.110.17
18.66.112.37
18.66.122.13
18.66.138.185
18.66.147.118
18.66.97.121
184.25.219.214
184.30.21.51
185.89.211.84
192.0.66.2
192.0.76.3
2.16.97.41
2.18.161.51
20.60.62.4
213.202.235.9
23.216.77.18
2600:9000:214f:f000:10:474e:104a:2961
2600:9000:223c:600:3:b7e:8940:93a1
2600:9000:225e:ec00:1:a3fa:7cc0:93a1
2606:2800:133:206e:1315:22a5:2006:24fd
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700:4400::6812:2089
2606:4700:4400::ac40:90a6
2606:4700::6810:5614
2606:4700::6810:7daf
2606:4700::6812:83ec
2a00:1450:4001:801::2008
2a00:1450:4001:80e::200a
2a00:1450:4001:810::200a
2a00:1450:4001:811::2002
2a00:1450:4001:811::200a
2a00:1450:4001:812::2001
2a00:1450:4001:812::2002
2a00:1450:4001:827::2004
2a00:1450:4001:827::200d
2a00:1450:4001:828::2003
2a00:1450:4001:829::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::200e
2a00:1450:4001:831::2002
2a00:1450:4001:831::2003
2a02:2638:d::d
2a04:4e42:e00::282
34.230.183.11
35.190.38.143
35.244.174.68
41.63.96.2
52.213.118.213
52.216.218.137
52.236.186.216
52.37.28.33
52.7.177.4
54.231.193.169
98.98.134.243
99.86.4.128
0003f7a90bac27bf9db67d824ccb4a6e8e9c05cf841b1c2ef342554c1088c03f
006c6ebd759be0b1f7879a1c5a6a7b90526d18f97c0f13de07a18895603516d8
01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392
0210fdc4c04e23f73485872c046ec10fb91221b5dcae5d9d9c71362ddcc94b7a
0373fc5a47c238cf139494574b7ddb8c586f81aad7e10de930b6a2d0b3cf4d5b
03c979666e740eb2c8f37487d38abcd304b6dbae793dfea0e1565b9a2ef46887
041f41b6b98e101febe7d24b8d7fdd9fd696dabad0fbe296c978272491c2a791
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1
04d75f9be78718605473f6f76319f2120d63e73e3c789b2b41d78896cbe13f63
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
074bbd0dd05f675add796b4572b8f3ec1827dcc1c17cbc203b35b9acc4b01d49
07eb86d32844a4bae782c9a243f8db9a435b9fa116c5b19f7de310789b9d63a8
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
0b3e489a84163694681634cba6001a3d86117a6b5c0432dc8308fe82f0dc1f3c
0cee972f52f443216ed569505738e89b08925201f31b5d7a51783ee9a0dcc785
0d9710c2a09a97b82f8ef3234516bbb07e11502b0b8e2ca75afc9aea49006a2d
0ebcb226f6a2a75fac2a800ee351cac06b0b9e403f7eeeacd7f046dfc7458af9
0f27b15848fb3a09df5fa1ba8e2ae9a80ca73faca61455767cd28318fd3c2c6b
0f7f22f2872f88cca7b3addb165c73d38e78ec21a055c749b12f15652ff97636
123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23
14f3a2330f6d02bcd5407635a03c7ab8ed1aa494914c05881137c5e86ae20acf
17d6015b753d0261069781fecd45cab46143e8091b6b8a61fa4c09fdef29e640
189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba
197028c6f96c74527ef8305b69e8b182c5f04c4a0f48e309a9f980cba6f6470b
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
1cff56c8c3ef4ba9d1393f78a10708a8ecf7a68ad29a411edec10b715ef46e12
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903
1ee5d0e791b0f16b20971f88babafc0040f2d7ae394a6c03efe4c3b7ffe29f03
20e98b335721c81d56cf4c48dfee8d9ca5be81ac71337db9044fa641781d97c7
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
25b33a7a853f39e447b14be3e6662ccbb0fbce73620bf7778d194cb3fef1d3ab
25e891f4e29e88cd8ac5ab0b7824a2233569d8a1de4048db0abfe914c54ec10b
27fcb96306f3d25af60404672c891032d6e970163584e212c0d0655659cc47e3
29806d98a0e2a7cec94df29c4641aa452e1b57c8cc5aec407c7ce95defa46ab4
2b663ab6a199de613fa46b2c524da1bfb8a889234879c5ccdb239602468e5f8e
2c95bbac8e167a1fd9297768d9c45d1f50db54733b750ae889b3a5efd2fae8fa
2da7205419537443243ac1dfa7d247dac2dd1ebaab040a4713b796932fba08b9
2f218961fc995f27f5868268ca3f765d4e7066eb6144139ce5b9eefe9b9ad443
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c
326e944f127ab38123a5a84a11393f998ce9b682df316a1c8ce8bba39669051c
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3517f86b0b10a1eaa987e8d95889c50febf5c1ac74ad893f43e689b4716234e3
35463ce93e7c820faa404db98d939ff640ae78ca0e29be043861853c9e07c586
35d3560abefdd86f4994b166ac3ba59f4ebf264b78310a63c7faf4c0e2d1c824
3685b0d2d30a73cb28673877c8cc72756fa8783836687c0c78108dcf29cdf0b5
36ff92531f15c249815b6b0b5ac0728419c25d626a3f54ff40111031b3ebf10f
37b564138a8c782c7ef7f804054712a1bb75a63677dca0e6e186b82102aebb93
39b076e4bb4fab9b8a142499cf6155f8c128464974691a04de7e764f71b72618
39d650fd0482142334e4c72a388b81d6148d10798c7fc2386e7692b679d1ecc0
3c1d802559944b61cc07ab614481c2845100fb437102061d3d5895c6706a9e9b
3e585193e120a224a14a3f7638680b4558d7f9623c34731f86cd9cbb953bb1d0
3e84c37934c40a6f03d4f161855191caa5f1922eac755fef48f36b87c78b720c
406f39e8d43621372cc26980295d23da7487978b4de6175246a70858ff3d0b46
42953d1747f4fe07f37cc5eff38e59f4cf1a4dce07b8e984d7151b8e13d95b15
437d538c1860b956d5d07c4127fe99bac2539cb041259c29f7910d41c778bf06
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
463b965e90a6c1e92161047e09f18a7b0c5bfe39c59de875536a744922f18285
465f488adc6928721a3cfb9149c1a04e2d1fe1ec672519df94271da85512b9a8
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4886b3c7f8a5307a61109fb5209f6085613f249e174a6e1476fbe685f3e1d0d2
49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a
4c5569ecbfb0d31b21c3956bd9775fd78d3b995746cea583067f7b20fdedf0b5
4c5b3602ae50fe7e3db7088031b1c0f7b628ab60a6b06605281fad0ecd7c4840
4cbab0bee86aa4bd4bd6d9bb6fe0002a85b9c27afde6f863ab139048e37400cd
4d04e98fa76e2cdba4b0b45b0b206b13de39ff72f6371b7d97ed515e21646722
4e8e1dd69ccfd9defa4af6df60aa65d5c7616a79e9d1540aeab9ba02f9b92d0c
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
4fa898d9bdc34304905c4b165e561c8dc3fe452b0bdd7259140e1aa530a42136
4fdf465af8bd5bf654a1df5aae739993f58fc9435ce0a9b3020bf9b37809cd11
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
55033882e1bc61cac58471a0ce5372606abd57a9663921dbd6f9a4a926c601b0
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
55ae555c3de73491aeff78da9644886ef48e990ef46e73b9206e741a1a89ef92
57503912b5baa2dc7f82654deea8c4e0dc02d5c9307f340ba693d4be28c544a0
57da29f239e3a7666bd246c66b55872bf8e6e36c1683695dc772d143631f528c
5916546f4709fbd69d7e1335e2a10b7587d5144c31aa61bee73bd2f9b68ba29e
5a839b5a6e073a96d1681b1f0f96fba964fe8bda49cc60eda5f748b37fc4b253
5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8
5ce0cb7f558c1aca9c6e94c7d85d76db859218132923c039b7ef7b38a29f8dfd
5e809cf73b7be36583f41bf8450c6f3cde0fbd6b868b5d5fc9e1420814ce3ebf
5e97284162b8feab4655d445aa676825b2d70dc72324ba1df3032c936c0586b7
60322b48dbf3ed19643a4422d1b99c8a47e700df8adb57b412ddabf304006064
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
63f681f0a4e4a5bd2075e8afea83b46c8b50fb36fa77fd302f99100cddb0e087
65e4475c9ad5a54ecdf6590313e8c380af2e1caf16bc4b9b3e9fbdf7b173a7f8
670c9af9f3dca88056da94209d8ca61c0d752fc3d7dbbdb4c232d81897e6d490
675371a6e4ce4e3907ce894a5730ac84e011c3ff5d9358f5e7991f105d3a4260
69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
69e30805defbf34fa451a87b0d7c41026d31d627fcb0cc8a2b63a8fd87d08888
6a85cb4f69ef025b2b86a217f8e999a8f30f43181f15017115e807dd5b021766
6b647dc4230a3e6a9d7e3c9cbd9f99a5a4498174099189428ff9b828a314727b
6d473c042c8d4d5dc49e13bdee4ddfbfdfdb16835d4ee23f363b3ff608e08d0c
6d67b67282c6ee3fecf5d2837f3f4f05d35fc863fa9aef17639494ae36e0aafb
6dbc46474fe4c5c63cf48d8f0366b393e0bd23ab359ab547d373079512959126
6efef9bc262d0ff2742b3f3d031c23c5e329af2e81b91eee6058835d45365ff5
716a727e47216ad28191f60fb09d59015b1bcb3df8cc32b5bb94f73d534a5732
726072642d7ac63adb4f7dd891cbb3fd56ed23b825e2fc64f3fec029e372693e
743e9c58c16fe8235da8d0d9c0c026eb0d0d4696cd1e60a394cb80b8689c1907
743fab9929b06e6ea08ee7296b84d0068d27d9fe7552b69f351a3298b968910a
749c246fc42cd7cfb7378c500ae5c87405320dc3661acac369453c201ece5a4b
74c2c6465e9aaff9a8052a5f001335f76a558ef3538e2674cbc27a6bb955b699
74c39b5ec5a61c19ff20d81c0418fabd61d6deb6ac0c967da28761d6b895ff7d
75b9f7cb9145ab6ba7dab006ea44900ba52c69191d2fc9dfc14c534980c07965
75e752bf99299219069a5af90f61408be1ab85af71df9aea097bc70e9075c122
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
79e7bd757fef28db64ff51fd2c2a9a3c0e9e5df3904f9956ae1a97027d169c3a
7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c
7b7432ac842f8423f422e24e0782071576596df5c2eaf2d4e92c0dc0b846ecf8
7bb8f25f111a5c210d1c97b500680682cf9b39730b2a332eb5009a7af047ef56
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
7c4280940a27f543999da03f1288b78300fbf0c4f2b92b728a4f67177cd95bd0
7c51552210cf46e54bf684795ac5ac9b03af17e73f0c96fbf03a798ecb56e49e
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
7e6e3565ba002c2245e78e8f26dc94e65b3354e1158eab503f82d30033a4289d
7f5d73c848836745a93ff7aa540a8f83f9899e3668628f42e9ba0cc6ef5e0b32
853ee1c67a9ac25bbb69a3c79b6cc94d8dd5c348eaf346a08fce94931dde3687
866768efa051d0eaedf6cf4deca40571ee594a591992a51c7bf7de4a34cb78c1
8c744f10e20a324bfbffb41bab817b514b0006ddb42910d450dea2a6bb933d3a
8fa5f1b25199584dbfacc66a6ff1aa27bacf8ba50e22c210341747e188e3533f
8ff7a2435af85471afe50a0b4973b35b4b23f002784fc98082be7f596dcd0af2
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
933ff38629199ba200d23e1a3afda3ca9cae06352169926a4609942ab4d3742b
93d1afa10fc671cb2fd0d301fe7a11152fd513a3c26e764364cc3653d7b9a711
950ce0924dffa9f9efc60bca449538c0cfdcc4708ab31ecbd3c52d0980552131
986ccecb5ddec6d653cdb03022cbb35af07301b752cad8ac1d6c7aa66a11e661
9a9749a3f7347ea1574bde5460000be360ba72224ac5c34848dda53ec85e62d4
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
9b40cfdc0fab43f2b7bb1d00fa1f5982cd650a25dbab95320bd43e8256865e8d
9d7dc41759aab2379209357a1c1afd9607a7278357e914d3b9125f0a79b399c7
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
9e6683f38016b2a2deeecde460d3a5829fe0e7d657f00e02cb3ec247c89a36c7
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1666cedb46a95dc2fde18873f9c59fc2e7599f6cef27694a90384b2697b3b4a
a1ff5bcbdd5695b6d3d4dc997c516846a50989edd2e34f8691cc301ed4e8fca5
a236aecfc3ef480b29e1a8be4b153aea8d2c6c53cd1b79044188ea662fb02143
a2e0d2de51dc225af114789fc0740e5c4e84f03335b755d04bada07003141d8a
a44f5d561cd3e602e092304c1356809a206492fa189be1c11d923e8e768b06b5
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
a576a611858274b01aeb1c6beddc745964205e3a5d955088c8c5163dc0d654a2
a6193c2b97fc947477fac5b4a4876de16583c0a634dde96ad32560426ed4975f
a69fb09b92c810ffc31ce707038f15a90f62e0583d1bfc0485daf231cf3551ba
acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a
aded3c1f5dfa0d8cc79cb7dda63824fdabad2af2fa414da7c094d5913d2d6e76
ae6002ac15022650c642b3b75d201bfa0478f2b1cccf1ce75024dd317aff3166
aee4051a20e975b9bb6fdc20984a091eb1f55c35ea87abe441db4cdbe8c116d0
af791f4ecfb200dd519a03dc1760721fd4fc36cd3ef9f0b5caf592f9a3d49b91
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5
b3362b0dbba74336a8203d642fdcca76552ebcd5b8ea581054ae46da0a09732f
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
b50ec7e9f4cbb719ea8e0d7d191782eece40414875810acbfa602794751a5ec4
b74420758de35d9e305c4be91525ace39bc3961b99841ab0624834b863b7cd01
b8ae278df4ce0cd32b3a198f6ff6c029aeb7c246adffc7c045c873b68c01bfab
ba5a6577ef04a324ae8a4af890e1e26d341ac85bc5c49ad9be1678a61fcc3168
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9
bfbb54f82cb7b361d04b96a835bc88a7e531382f0c8b7fbd7dc587305dc0d1a1
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c44e080ef80f83f7fc346253431046ff2bfe10ff0762acc1c247be5e169547ea
c4814310946174eddc533d431b27ae3dc306fc5413bd87cc1196f34b2111bb03
c50fbc8b93d93020dcd019b9a9c035fef70c9338216b0fd85b02e8dfd1913f63
c540cdeba4eb897beea1c93c6452269a4de7b86a2e670b5b0ad37f9bbfc78c53
c541fb7b037e7c9dd5ff3425f3c3431301f9727dd7ae2b59cc882499126c531c
c5cfcd9ec414a81b822e86f4976a78abb71176739e963d4c64484f82bcbfa09f
c614e01a3542201b8293054ba6b023c499fa1fd71bfcd9913ad0eb1d9d538566
c6ce25eec9f88c5082f31ab03c9e870e3109e8e14870b0a3be1f28230ecb00ac
c76d76b093bc29fc443d18c6816c16aafc66a82cd845316635c618ed8654b726
c8ca051f24c9b771310374d1c018407fe47f58a95ab8f9a0aa5251bbb9f6ad32
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258
cbccc935557398179deeef044a5ab2353e97ca4961f313793c8ba03964c43e93
cc0d3b25b32badef4ae36e085282e8c2eb6e34e5d035994b504eefd30e6c6e29
cc8f971a86896a467741bf384dbd4386754892b8c71b775c2519d295ce224c7a
cd745fcc8b0238d900dbf1d6774fead42beb5b5383bf040833d3afc135f2aee3
cdd102d71e33401eb5ebadb19f1732edafa44df8800da6d33f29329c3ed9baef
d1c340e270dec930ebae95bcb524a0c10bcc970da285bd0ff49ccc494a97d3e9
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
d563298c3ede28f01a71384931c619cda9aadce1007034f284f3c0f0316303f0
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d754496959e848b85bd3c06db73ac335d58589484a13010a1e0d4cccefaaf5a0
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
d8132d45eef1f2500760399505fc221a79a3bbe60ed797bbc24599a650e69927
d818dff57432379290cfdcc9cba750fc3cf36318dc06e3ad3a3e3ccaaf5eaf5b
d85f6474893e823b6eb6ce2ad936235ff13be5d10d1c1dba6517f6dd3a731c59
d873f234380734f74e852b1f25a35b0ddb23a5336da1f32cd4cf4239f6fa2d41
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e136a43275cfd6956929800912432b8d7131f1c05dfdd9902fd3bbfd1ee2956b
e181730c1a666b38b299b81ead525f7fec078ff980360b4c032e75b9802ebf0d
e234a07894bf7b198119f3994a9961821a75bdee43f64cb42b5be4ca22164055
e24790d48c25018db898cdff402eba2b270ada160db7bc7464530e20c5ab5f83
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5d4d4e17edb1ca2bbd89a4369dee79511e43c1355c00db20cd8d8eacf4b55be
e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216
eaadcf5b3b699ca48354c38b1e4b85b9b36fba5cdf93fbd78e0ce18fb838dd97
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1ffaa351819f5d0479c92f25bd7143322acbb19e00aaea292571abd25d82ae1
f35a7a3eb28e1da39e87276b8f75d6203b808e26b63218ffb0be3fd62e0de605
f39747a909c8b87831f585d5930385facbbecdc9badbd18c464195c4272b8d59
f3988a8a95c5faec9bb5307667596b220a12d277072950244393b5f33091e2fb
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f3fd1a56c0d16459bf2d035ad3bf5a65aeb15f387867e4a57d08c0cf3dbb3fa8
f45f32a66717afe2f3b53cd741ed6d8802a4e4cb4731a3d44c6428621af7aece
f6d8894bccb6968f9c55a23894a63a454f3425a7a4c19251ba01d9e3493084a0
f7b2bde5796819d3b518e597ffeb8298f1d85878a09316615fa34d7f6836a638
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f96f224f55ce77a223d7bf504b848782067cc044f4a282f4018b5c0f2fa7de24
f9c4ffcfab2c93ba07bd2d4a2dd53a1d23faace457ade18c52c3f4ea67b8ea68
f9d24c71e954513157a412b5339112437e013cf99070b258e445101f16747500
fc73b938f142ca68cea010123bbfcd4820b16c9db828e5b4be9be288d0961b68
feb0e7f17014201ea9124f23e3f63965411385abf0103fc682595d0674087a0c